SSO and Azure/O365

[Steve Herrera]

Hello,
 We are trying to get our SSO setup with Azure and are running into some
issues. I believe we are very close but I'm not sure how to resolve the
final error messages.  We are running IDP 4.1.4 in this instance. I have
been following the documentation at
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1401782516/Office+365

My configurations are as follows:

Attribute-resolver.xml:
The 2 attributes we are working with.

<AttributeDefinition xsi:type="Simple" id="ImmutableID" xmlns=
"urn:mace:shibboleth:2.0:resolver:ad" >

        <InputDataConnector ref="activeDirectory" attributeNames=
"objectGUID" />

    </AttributeDefinition>


<AttributeDefinition xsi:type="Simple" id="UserID">

    <InputDataConnector ref="activeDirectory"

attributeNames="userPrincipalName"/>

        <AttributeEncoder xsi:type="SAML2String" name=
"urn:oasis:names:tc:SAML:2.0:protocol" encodeType="false"  />

</AttributeDefinition>


<!-- Active Directory Connector -->

    <DataConnector id="activeDirectory" xsi:type="LDAPDirectory"

        ldapURL="%{idp.authn.adLDAP.ldapURL}"

        baseDN="%{idp.authn.adLDAP.baseDN}"

        principal="%{idp.authn.adLDAP.bindDN}"

        principalCredential="%{idp.authn.adLDAP.bindDNCredential}"

        trustFile="%{idp.authn.adLDAP.trustCertificates}">

        <LDAPProperty name="java.naming.ldap.attributes.binary" value=
"objectGUID" />

        <FilterTemplate>

            <![CDATA[

            sAMAccountName=$resolutionContext.getPrincipal()

            ]]>

        </FilterTemplate>

    </DataConnector>


relying-party.xml:

<!--Microsoft Azure required for O365 -->

        <bean parent="RelyingPartyByName" c:relyingPartyIds=
"urn:federation:MicrosoftOnline" >

            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.ECP" p:encryptAssertions="false" p:
signAssertions="true" p:signResponses="false" p:nameIDFormatPrecedence=
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />

                    <bean parent="SAML2.SSO" p:encryptAssertions="false" p:
signAssertions="true" p:signResponses="false" />

                </list>

            </property>

        </bean>



saml-nameid.xml:

<!-- Microsoft requires a custom Persistent ID Generator that sends the AD
GUID -->


        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

                 p:format=
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

                 p:attributeSourceIds="#{ {'ImmutableID'} }" >

            <property name="activationCondition">

                <bean parent="shibboleth.Conditions.RelyingPartyId" c:
candidates="#{{'urn:federation:MicrosoftOnline'}}" />

            </property>

        </bean>


Below is the error message I get in the idp.process.log. I know it is
referencing the ImmutableID in the attribute-resolver.xml file. I think the
issue is the namespace but all my attempts have failed.



ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
- Service 'shibboleth.AttributeRegistryService': Initial load failed

net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
302 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 302; columnNumber:
106; cvc-complex-type.2.4.a: Invalid content was found starting with
element '{"urn:mace:shibboleth:2.0:resolver:ad":AttributeDefinition}'. One
of '{"urn:mace:shibboleth:2.0:resolver":AttributeDefinition,
"urn:mace:shibboleth:2.0:resolver":DataConnector}' is expected.

at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)

Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
302 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 302; columnNumber:
106; cvc-complex-type.2.4.a: Invalid content was found starting with
element '{"urn:mace:shibboleth:2.0:resolver:ad":AttributeDefinition}'. One
of '{"urn:mace:shibboleth:2.0:resolver":AttributeDefinition,
"urn:mace:shibboleth:2.0:resolver":DataConnector}' is expected.


Steve Herrera
Information Security
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210730/42ca90f3/attachment.htm>