Shib v4 hybrid proxying via Azure AD

Mon Mar 1 21:03:36 UTC 2021

Totally not an expert on this, but I ran into this issue a few weeks ago.
In addition to what Jeffrey said, make sure that you have the transcoding
properties configured correctly (I created a new file in conf/attributes
and make sure this file is added to conf/attributes/default-rules.xml). I
had confused the values for "id" and "saml2.name"; the latter should match
the attribute release from the proxied IdP.

ajs

On Mon, Mar 1, 2021 at 2:54 PM Jeffrey Williams via users <
users at shibboleth.net> wrote:

> I have this running in our val environment and ran into that error in the
> past.  For us, it was having to do with Shib not being configured to parse
> the returned attribute to be used to poll your attribute source.
>
> For starters, confirm that you have the c14n/attribute bean uncommented in
> conf/c14n/subject-c14n.xml.  I don't think that's expressly given in the
> docs.
>
> -Jeff
>
>
>
>
>
>
> On Mon, Mar 1, 2021 at 2:33 PM Goggins, Patrick via users <
> users at shibboleth.net> wrote:
>
>> Building up a new Shib v4.0.1 IdP (under WS2019) utilizing Azure AD for a
>> hybrid release.
>>
>> Finished running through the documentation steps a few days ago but
>> running into some issues with crosswalk mapping. I’ve enabled SAML
>> debugging to isolate the issue but not sure where the adjustment needs to
>> be made.
>>
>>
>>
>> 2021-03-01 12:37:13,960 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile
>> Action ValidateAssertions: Assertion validation result was: VALID
>> 2021-03-01 12:37:13,960 - 143.200.128.40 - INFO
>> [Shibboleth-Audit.SSO:282] -
>> 143.200.128.40||2021-03-01T18:37:13.960349500Z||
>> https://sts.windows.net/7fc34f9d-1f75-4f96-b5b3-3cdcxxxxxxxx/|_d92d198a-ea74-4517-babe-37533dae0200|password|2021-03-01T18:37:04.031Z|azureObjectidentifier,azureIdentityprovider,azureGivenname,azureAuthnmethodsreferences,azureDisplayname,azureTenantid,azureEmailaddress,azureSurname|samltest@uwgb.edu|emailAddress||false||Redirect|POST||Success|||Mozilla/5.0
>> (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
>> Chrome/88.0.4324.190 Safari/537.36
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - ERROR
>> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
>> Profile Action SelectSubjectCanonicalizationFlow: No potential flows left
>> to choose from, canonicalization will fail
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - INFO
>> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile
>> Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to
>> intermediate set
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - INFO
>> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile
>> Action SelectAuthenticationFlow: No potential flows left to choose from,
>> authentication failed
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] -
>> Error event NoPotentialFlow will be handled with response
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] -
>> Profile Action AddStatusResponseShell: Setting Issuer to
>> https://idpdev.uwgb.edu/idp/shibboleth
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] -
>> Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to
>> outgoing Response
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile
>> Action AddStatusToResponse: Detailed errors are disabled
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:220] - Profile
>> Action AddStatusToResponse: Setting StatusMessage to defaulted value
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] -
>> Adding destination to outbound SAML 2 protocol message:
>> https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
>> 2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG
>> [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
>> - Message Handler:  Checking outbound endpoint for allowed URL scheme:
>> https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST
>>
>> I’m assuming the issue is with Proxy Task 4 which has been setup.
>>
>> Attribute-resolver set to:
>>
>> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
>> forCanonicalization="true" id="canonicalNameToUseForJoin"
>> principalAttributeName="azureName" />
>> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
>> forCanonicalization="false" id="mail"
>> principalAttributeName="azureEmailaddress"  />
>> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
>> forCanonicalization="false" id="displayName"
>> principalAttributeName="azureDisplayname"  />
>> <AttributeDefinition xsi:type="SubjectDerivedAttribute"
>> forCanonicalization="false" id="eduPersonPrincipalName"
>> principalAttributeName="azureName"  />
>>
>> The two extra definitions to the c14n have been added as well. In this
>> config, I’m hoping to doing a basic release via Azure AD attributes, then
>> add in the rest of the attributes via ldap to AD locally.
>>
>>
>>
>> Patrick Goggins
>>
>> Senior Network/Systems Administrator
>>
>>
>> ............................................................................................
>>
>> Division of Information Technology
>>
>> University of Wisconsin – Green Bay
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> Jeffrey Williams
> Identity & Access Engineer
> Identity & Access Services
> https://its.uncg.edu
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 
*Tony Skalski*
System Administrator | IT

*Office: *507-786-3227 <(507)786-3227>
1510 St. Olaf Avenue Northfield, MN 55057
stolaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210301/e77945e5/attachment.htm>