alternate attributeSourceIDs for a given nameid format

Fri Mar 12 04:03:40 UTC 2021

I was experimenting with the IdP-initiated (unsolicited) SSO possibilities
to differentiate between the SP's instances, so tried adding a target
parameter to the entityID for my activation condition like so:

       <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                p:attributeSourceIds="#{ {'attrEmail_aberrant'} }" >
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="SP_entityID_aberrant&target=aberrant" />
            </property>
        </bean>

But this results in the parsing error on reload:

ERROR [net.shibboleth.idp.profile.impl.ReloadServiceConfiguration:132] -
Profile Action ReloadServiceConfiguration: Error reloading service
configuration for 'shibboleth.NameIdentifierGenerationService'
net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
80 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is
invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 80;
columnNumber: 129; The reference to entity "target" must end with the ';'
delimiter.

I'm not sure where exactly it's expecting the ';'. I don't see it in the
examples in the documentation (where ';' would be url-encoded as %3b)?
<
https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration#UnsolicitedSSOConfiguration-Examples
>

On Thu, Mar 11, 2021 at 8:50 AM Baron Fujimoto <baron at hawaii.edu> wrote:

> Mahalo to Phil Pishioneri who spotted the problem and suggested the
> solution to me: missing ">" at the end of the p:attributeSourceIds line,
> which yields the working entry:
>
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>                 p:attributeSourceIds="#{ {'attrEmail_aberrant'} }" >
>             <property name="activationCondition">
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidate="SP_entityID_aberrant" />
>             </property>
>         </bean>
>
> Since I only expect to use this exception and custom attrEmail_aberrant
> attribute for this particular SP, I think
> the c:candidate="SP_entityID_aberrant" is probably fine. This form is
> provided as an example for a single SP here:
> <
> https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-SpecificRelyingParties
> >.
> If this were applicable to multiple SPs, you're right I'd want the plural
> candidates form.
>
> On Thu, Mar 11, 2021 at 8:01 AM IAM David Bantz <dabantz at alaska.edu>
> wrote:
>
>> maybe...
>>
>>  c:candidate*s*="#{ {‘SP_entityID_aberrant' } }” ...
>>
>> On 11Mar, 2021 at 08:42:04, Baron Fujimoto <baron at hawaii.edu> wrote:
>>
>>> I was able to script an attribute, attrEmail_aberrant, suitable for this
>>> SP, but ran into an XML parsing error trying to use it via an activation
>>> condition in saml-nameid.xml with the following entry:
>>>
>>>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>>>
>>> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>>>                 p:attributeSourceIds="#{ {'attrEmail_aberrant'} }"
>>>             <property name="activationCondition">
>>>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
>>> c:candidate="SP_entityID_aberrant" />
>>>             </property>
>>>         </bean>
>>>
>>> Error when I reload:
>>>
>>> ERROR
>>> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231]
>>> - Service 'shibboleth.NameIdentifierGenerationService': Reload for
>>> shibboleth.NameIdentifierGenerationService failed
>>> net.shibboleth.utilities.java.support.service.ServiceException:
>>> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
>>> 64 in XML document from file [/home/shib/idp/conf/saml-nameid.xml] is
>>> invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 64;
>>> columnNumber: 13; Element type "bean" must be followed by either attribute
>>> specifications, ">" or "/>".
>>>
>>> On Wed, Mar 10, 2021 at 9:06 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>>>
>>>> On 3/10/21, 1:03 PM, "users on behalf of Baron Fujimoto" <
>>>> users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:
>>>>
>>>> >    I'm afraid my grasp of IdP-initiated SPs is poor and I don't yet
>>>> have an inkling how we might begin to
>>>> > implement these possibilities without more explicit documentation or
>>>> examples.
>>>>
>>>> That's the benefit of membership, to be brutally frank.
>>>>
>>>> >    Getting back to the original suggestion by Gary Lipscomb, may we
>>>> can kludge that after all, assuming we can
>>>> > have multiple SAML2AttributeSourcedGenerator beans in saml-nameid.xml
>>>> that use result in the same nameid
>>>> > format, but use different attributeSourceID. If so, would these beans
>>>> be order dependent on a first match basis
>>>> > (like metadata?). Ie. something like this?
>>>>
>>>> Yes, that is probably the best fix for this issue, just release the
>>>> unusual source attribute to just that SP and then it won't ever run
>>>> successfully for any other, generators just fall through if they have
>>>> nothing to operate on.
>>>>
>>>> -- Scott
>>>>
>>>>
>>>> --
>>>> For Consortium Member technical support, see
>>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>>
>>>
>>>
>>> --
>>> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>>> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>>> --
>>> For Consortium Member technical support, see
>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210311/92f330f8/attachment.htm>