Shib v4 hybrid proxying via Azure AD

Mon Mar 1 20:54:08 UTC 2021

I have this running in our val environment and ran into that error in the
past.  For us, it was having to do with Shib not being configured to parse
the returned attribute to be used to poll your attribute source.

For starters, confirm that you have the c14n/attribute bean uncommented in
conf/c14n/subject-c14n.xml.  I don't think that's expressly given in the
docs.

-Jeff

On Mon, Mar 1, 2021 at 2:33 PM Goggins, Patrick via users <
users at shibboleth.net> wrote:

> Building up a new Shib v4.0.1 IdP (under WS2019) utilizing Azure AD for a
> hybrid release.
>
> Finished running through the documentation steps a few days ago but
> running into some issues with crosswalk mapping. I’ve enabled SAML
> debugging to isolate the issue but not sure where the adjustment needs to
> be made.
>
>
>
> 2021-03-01 12:37:13,960 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile
> Action ValidateAssertions: Assertion validation result was: VALID
> 2021-03-01 12:37:13,960 - 143.200.128.40 - INFO [Shibboleth-Audit.SSO:282]
> - 143.200.128.40||2021-03-01T18:37:13.960349500Z||
> https://sts.windows.net/7fc34f9d-1f75-4f96-b5b3-3cdcxxxxxxxx/|_d92d198a-ea74-4517-babe-37533dae0200|password|2021-03-01T18:37:04.031Z|azureObjectidentifier,azureIdentityprovider,azureGivenname,azureAuthnmethodsreferences,azureDisplayname,azureTenantid,azureEmailaddress,azureSurname|samltest@uwgb.edu|emailAddress||false||Redirect|POST||Success|||Mozilla/5.0
> (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
> Chrome/88.0.4324.190 Safari/537.36
> 2021-03-01 12:37:13,975 - 143.200.128.40 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action SelectSubjectCanonicalizationFlow: No potential flows left
> to choose from, canonicalization will fail
> 2021-03-01 12:37:13,975 - 143.200.128.40 - INFO
> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile
> Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to
> intermediate set
> 2021-03-01 12:37:13,975 - 143.200.128.40 - INFO
> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile
> Action SelectAuthenticationFlow: No potential flows left to choose from,
> authentication failed
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] -
> Error event NoPotentialFlow will be handled with response
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] -
> Profile Action AddStatusResponseShell: Setting Issuer to
> https://idpdev.uwgb.edu/idp/shibboleth
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] -
> Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to
> outgoing Response
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile
> Action AddStatusToResponse: Detailed errors are disabled
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:220] - Profile
> Action AddStatusToResponse: Setting StatusMessage to defaulted value
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] -
> Adding destination to outbound SAML 2 protocol message:
> https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
> [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
> - Message Handler:  Checking outbound endpoint for allowed URL scheme:
> https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
>
> I’m assuming the issue is with Proxy Task 4 which has been setup.
>
> Attribute-resolver set to:
>
> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
> forCanonicalization="true" id="canonicalNameToUseForJoin"
> principalAttributeName="azureName" />
> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
> forCanonicalization="false" id="mail"
> principalAttributeName="azureEmailaddress"  />
> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
> forCanonicalization="false" id="displayName"
> principalAttributeName="azureDisplayname"  />
> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
> forCanonicalization="false" id="eduPersonPrincipalName"
> principalAttributeName="azureName"  />
>
> The two extra definitions to the c14n have been added as well. In this
> config, I’m hoping to doing a basic release via Azure AD attributes, then
> add in the rest of the attributes via ldap to AD locally.
>
>
>
> Patrick Goggins
>
> Senior Network/Systems Administrator
>
>
> ............................................................................................
>
> Division of Information Technology
>
> University of Wisconsin – Green Bay
>
>
>
>
>
>
>
>
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 
Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
https://its.uncg.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210301/0d63e5d3/attachment.htm>