Canonicalization flow c14n/SAML2ProxyTransform was not applicable: reason unknown

Tomas Stenlund tomas.stenlund at telia.com
Mon Jan 3 06:02:07 UTC 2022


Hi,

I have a problem with one IdP out of two when I use 
c14n/SAML2ProxyTransform for the PostLoginSubjectCanonicalizationFlows 
during SelectSubjectCanonicalizationFlow. It does not say much, more 
than the statement above in the email subject.

I have added urn:oasis:names:tc:SAML:2.0:nameid-format:persistent to the 
ProxyNameTransformFormats and added the entityID:s in the 
ProxyNameTransformPredicate:s. And the SAMLSubjectCanonicalizationFlows 
looks like this.

     <util:list id="shibboleth.SAMLSubjectCanonicalizationFlows">

         <!-- The next four are for handling transient IDs (in-storage 
and stateless variants). -->
         <ref bean="c14n/SAML2Transient" />
         <ref bean="c14n/SAML2CryptoTransient" />
         <ref bean="c14n/SAML1Transient" />
         <ref bean="c14n/SAML1CryptoTransient" />

         <!-- Handle a SAML 2 persistent ID, provided a stored strategy 
is in use. -->
         <!-- <ref bean="c14n/SAML2Persistent" /> -->

         <!--
         Finally we have beans for decoding arbitrary SAML formats 
directly. By default, these are turned off,
         having *no* circumstances for which they apply (see 
shibboleth.TransformNamePredicate below).
         -->
         <ref bean="c14n/SAML2Transform" />
         <ref bean="c14n/SAML1Transform" />
     </util:list>


Any idea where I should start looking, there is something I am obviously 
missing :-)

This is the assert that fails:

<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
ID="_d29f82767d25f25d81dd7c8d00f7304f" 
IssueInstant="2022-01-03T05:26:33.516Z" Version="2.0" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer>https://dev.connector.swedenconnect.se/eidas</saml2:Issuer>
     <saml2:Subject>
         <saml2:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
NameQualifier="https://dev.connector.swedenconnect.se/eidas" 
SPNameQualifier="https://galatea.stenlund.eu/proxy">HhZkCxP7GkZ2zOCAIqyu+U5/8wk=</saml2:NameID>
         <saml2:SubjectConfirmation 
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
             <saml2:SubjectConfirmationData Address="XXXXXXXXX" 
InResponseTo="_311311a20c67645d7a7a780618e773a5" 
NotOnOrAfter="2022-01-03T05:31:33.552Z" Recipient="XXXXXXXXXXXXXXX"/>
         </saml2:SubjectConfirmation>
     </saml2:Subject>
     <saml2:Conditions NotBefore="2022-01-03T05:26:33.516Z" 
NotOnOrAfter="2022-01-03T05:31:33.516Z">
         <saml2:AudienceRestriction>
<saml2:Audience>https://galatea.stenlund.eu/proxy</saml2:Audience>
         </saml2:AudienceRestriction>
     </saml2:Conditions>
     <saml2:AuthnStatement AuthnInstant="2022-01-03T05:26:32.938Z" 
SessionIndex="_034a622b0c5a0d2d177d81b91187c03b">
         <saml2:SubjectLocality Address="XXXXXXXXXX"/>
         <saml2:AuthnContext>
<saml2:AuthnContextClassRef>http://id.elegnamnden.se/loa/1.0/eidas-nf-sub</saml2:AuthnContextClassRef>
<saml2:AuthenticatingAuthority>https://xa.testnode.eidastest.se/EidasNode/ServiceMetadata</saml2:AuthenticatingAuthority>
         </saml2:AuthnContext>
     </saml2:AuthnStatement>
     <saml2:AttributeStatement>
         <saml2:Attribute FriendlyName="c" Name="urn:oid:2.5.4.6" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">XA</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="pridPersistence" 
Name="urn:oid:1.2.752.201.3.5" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">A</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="givenName" 
Name="urn:oid:2.5.4.42" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">Bernt Olof</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="transactionIdentifier" 
Name="urn:oid:1.2.752.201.3.2" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">_6w_0xAkmYOld5rgYIBHG-HsrpcCmPK4vqp.LHcrArv336yD6MHTpzt8ks9wzq53</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="eidasPersonIdentifier" 
Name="urn:oid:1.2.752.201.3.7" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">XA/SE/193911137077</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="prid" 
Name="urn:oid:1.2.752.201.3.4" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">XA:193911137077</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="dateOfBirth" 
Name="urn:oid:1.3.6.1.5.5.7.9.1" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">1939-11-13</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">Larsson</saml2:AttributeValue>
         </saml2:Attribute>
     </saml2:AttributeStatement>
</saml2:Assertion>

This is the assert that works:

<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
ID="_2416d5c8a2d5038bc017234e5cd7c0cd" 
IssueInstant="2022-01-03T04:42:45.353Z" Version="2.0" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer>http://dev.test.swedenconnect.se/idp</saml2:Issuer>

     </ds:Signature>

     <saml2:Subject>
         <saml2:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
NameQualifier="http://dev.test.swedenconnect.se/idp"
SPNameQualifier="https://galatea.stenlund.eu/proxy">VIVQWeo4duddDJ3B+ELb5++cjiI=</saml2:NameID>
         <saml2:SubjectConfirmation 
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
             <saml2:SubjectConfirmationData Address="XXXXXXXXXXXXXX" 
InResponseTo="_45fbbe69b6537b8ffb3fe61fcce30ba1" 
NotOnOrAfter="2022-01-03T04:47:45.398Z" Recipient="XXXXXXXXXXXXX"/>
         </saml2:SubjectConfirmation>
     </saml2:Subject>

     <saml2:Conditions NotBefore="2022-01-03T04:42:45.353Z" 
NotOnOrAfter="2022-01-03T04:47:45.353Z">
         <saml2:AudienceRestriction>
<saml2:Audience>https://galatea.stenlund.eu/proxy</saml2:Audience>
         </saml2:AudienceRestriction>
     </saml2:Conditions>

     <saml2:AuthnStatement AuthnInstant="2022-01-03T04:42:45.308Z" 
SessionIndex="_6870321ff2f05f504901161781ec19e9">
         <saml2:SubjectLocality Address="XXXXXXXXXXXXXXX"/>
         <saml2:AuthnContext>
<saml2:AuthnContextClassRef>http://id.elegnamnden.se/loa/1.0/loa3</saml2:AuthnContextClassRef>
         </saml2:AuthnContext>
     </saml2:AuthnStatement>

     <saml2:AttributeStatement>
         <saml2:Attribute FriendlyName="personalIdentityNumber" 
Name="urn:oid:1.2.752.29.4.13" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">197802031877</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="displayName" 
Name="urn:oid:2.16.840.1.113730.3.1.241" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">Tryggve Bäckström</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="givenName" 
Name="urn:oid:2.5.4.42" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">Tryggve</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="dateOfBirth" 
Name="urn:oid:1.3.6.1.5.5.7.9.1" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">1978-02-03</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
             <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">Bäckström</saml2:AttributeValue>
         </saml2:Attribute>
     </saml2:AttributeStatement>

</saml2:Assertion>


/Tomas

Failure LOG:

2022-01-03 05:26:33,998 - 192.168.1.1 - TRACE 
[net.shibboleth.idp.saml.authn.principal.impl.MapDrivenAuthnContextTranslationStrategy:100] 
- Passing unmapped value 'http://id.elegnamnden.se/loa/1.0/eidas-nf-sub' 
through
2022-01-03 05:26:33,998 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:317] 
- Profile Action ValidateSAMLAuthentication: Added translated 
AuthnContext Principals: [http://id.elegnamnden.se/loa/1.0/eidas-nf-sub]
2022-01-03 05:26:33,999 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:340] 
- Profile Action ValidateSAMLAuthentication: Adding filtered inbound 
attributes to Subject
2022-01-03 05:26:34,000 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:281] 
- Profile Action ValidateSAMLAuthentication: Resetting authentication 
time to proxied value: 2022-01-03T05:26:32.938Z
2022-01-03 05:26:34,019 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:75] 
- Profile Action PopulateSubjectCanonicalizationContext: Installing 1 
canonicalization flows into SubjectCanonicalizationContext
2022-01-03 05:26:34,020 - 192.168.1.1 - INFO [Shibboleth-Audit.SSO:283] 
- 
192.168.1.1||2022-01-03T05:26:34.020782Z||https://dev.connector.swedenconnect.se/eidas|_d29f82767d25f25d81dd7c8d00f7304f|http://id.elegnamnden.se/loa/1.0/eidas-nf-sub|2022-01-03T05:26:32.938Z|prid,givenName,sn|HhZkCxP7GkZ2zOCAIqyu+U5/8wk=|persistent||false||Redirect|POST||Success|||Mozilla/5.0 
(X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
2022-01-03 05:26:34,041 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - 
Profile Action SelectSubjectCanonicalizationFlow: Checking 
canonicalization flow c14n/SAML2ProxyTransform for applicability...
2022-01-03 05:26:34,042 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:167] 
- Attempting to match format 
'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2022-01-03 05:26:34,042 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:185] 
- NameIDCanonicalizationFlowDescriptor c14n/SAML2ProxyTransform: format 
matches urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2022-01-03 05:26:34,042 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - 
Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow 
c14n/SAML2ProxyTransform was not applicable: reason unknown
2022-01-03 05:26:34,042 - 192.168.1.1 - ERROR 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - 
Profile Action SelectSubjectCanonicalizationFlow: No potential flows 
left to choose from, canonicalization will fail
2022-01-03 05:26:34,044 - 192.168.1.1 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile 
Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to 
intermediate set
2022-01-03 05:26:34,044 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile 
Action SelectAuthenticationFlow: No specific Principals requested
2022-01-03 05:26:34,044 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:277] - Profile 
Action SelectAuthenticationFlow: Forced authentication requested, 
selecting an inactive flow
2022-01-03 05:26:34,044 - 192.168.1.1 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:281] - Profile 
Action SelectAuthenticationFlow: No potential flows left to choose from, 
authentication failed

Success LOG:

2022-01-03 04:42:45,767 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:317] 
- Profile Action ValidateSAMLAuthentication: Added translated 
AuthnContext Principals: [http://id.elegnamnden.se/loa/1.0/loa3]
2022-01-03 04:42:45,768 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:340] 
- Profile Action ValidateSAMLAuthentication: Adding filtered inbound 
attributes to Subject
2022-01-03 04:42:45,769 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:281] 
- Profile Action ValidateSAMLAuthentication: Resetting authentication 
time to proxied value: 2022-01-03T04:42:45.308Z
2022-01-03 04:42:45,786 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:75] 
- Profile Action PopulateSubjectCanonicalizationContext: Installing 1 
canonicalization flows into SubjectCanonicalizationContext
2022-01-03 04:42:45,788 - 192.168.1.1 - INFO [Shibboleth-Audit.SSO:283] 
- 
192.168.1.1||2022-01-03T04:42:45.788013Z||http://dev.test.swedenconnect.se/idp|_2416d5c8a2d5038bc017234e5cd7c0cd|http://id.elegnamnden.se/loa/1.0/loa3|2022-01-03T04:42:45.308Z|sn,personalIdentityNumber,displayName,givenName|VIVQWeo4duddDJ3B+ELb5++cjiI=|persistent||false||Redirect|POST||Success|||Mozilla/5.0 
(X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
2022-01-03 04:42:45,810 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - 
Profile Action SelectSubjectCanonicalizationFlow: Checking 
canonicalization flow c14n/SAML2ProxyTransform for applicability...
2022-01-03 04:42:45,811 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:167] 
- Attempting to match format 
'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2022-01-03 04:42:45,811 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:185] 
- NameIDCanonicalizationFlowDescriptor c14n/SAML2ProxyTransform: format 
matches urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2022-01-03 04:42:45,812 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - 
Profile Action SelectSubjectCanonicalizationFlow: Selecting 
canonicalization flow c14n/SAML2ProxyTransform
2022-01-03 04:42:45,853 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:167] 
- Attempting to match format 
'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2022-01-03 04:42:45,854 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:185] 
- NameIDCanonicalizationFlowDescriptor c14n/SAML2ProxyTransform: format 
matches urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2022-01-03 04:42:45,858 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile 
Action DetectIdentitySwitch: No previous session found, nothing to do
2022-01-03 04:42:45,858 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:116] - Profile 
Action FinalizeAuthentication: Canonical principal name was established 
as 'VIVQWeo4duddDJ3B+ELb5++cjiI='
2022-01-03 04:42:45,859 - 192.168.1.1 - DEBUG 
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:173] - Profile 
Action FinalizeAuthentication: Request did not have explicit 
authentication requirements, result is accepted



More information about the users mailing list