Shib v4 hybrid proxying via Azure AD

[Goggins, Patrick]

Building up a new Shib v4.0.1 IdP (under WS2019) utilizing Azure AD for a hybrid release.
Finished running through the documentation steps a few days ago but running into some issues with crosswalk mapping. I've enabled SAML debugging to isolate the issue but not sure where the adjustment needs to be made.

2021-03-01 12:37:13,960 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile Action ValidateAssertions: Assertion validation result was: VALID
2021-03-01 12:37:13,960 - 143.200.128.40 - INFO [Shibboleth-Audit.SSO:282] - 143.200.128.40||2021-03-01T18:37:13.960349500Z||https://sts.windows.net/7fc34f9d-1f75-4f96-b5b3-3cdcxxxxxxxx/|_d92d198a-ea74-4517-babe-37533dae0200|password|2021-03-01T18:37:04.031Z|azureObjectidentifier,azureIdentityprovider,azureGivenname,azureAuthnmethodsreferences,azureDisplayname,azureTenantid,azureEmailaddress,azureSurname|samltest@uwgb.edu|emailAddress||false||Redirect|POST||Success|||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
2021-03-01 12:37:13,975 - 143.200.128.40 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
2021-03-01 12:37:13,975 - 143.200.128.40 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2021-03-01 12:37:13,975 - 143.200.128.40 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] - Error event NoPotentialFlow will be handled with response
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] - Profile Action AddStatusResponseShell: Setting Issuer to https://idpdev.uwgb.edu/idp/shibboleth
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile Action AddStatusToResponse: Detailed errors are disabled
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:220] - Profile Action AddStatusToResponse: Setting StatusMessage to defaulted value
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] - Adding destination to outbound SAML 2 protocol message: https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52] - Message Handler:  Checking outbound endpoint for allowed URL scheme: https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
I'm assuming the issue is with Proxy Task 4 which has been setup.
Attribute-resolver set to:
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="true" id="canonicalNameToUseForJoin" principalAttributeName="azureName" />
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="mail" principalAttributeName="azureEmailaddress"  />
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="displayName" principalAttributeName="azureDisplayname"  />
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="eduPersonPrincipalName" principalAttributeName="azureName"  />
The two extra definitions to the c14n have been added as well. In this config, I'm hoping to doing a basic release via Azure AD attributes, then add in the rest of the attributes via ldap to AD locally.

Patrick Goggins
Senior Network/Systems Administrator
............................................................................................
Division of Information Technology
University of Wisconsin - Green Bay





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210301/8b3548d0/attachment.htm>