Shibboleth 4.2.1. Identity Provider and OneTrust (SP)

[Stefano Bridi]

On Fri, May 13, 2022 at 1:19 PM Nate Klingenstein <ndk at signet.id> wrot
Thanks Nate,

No.  Shibboleth only loads certificates from provider metadata.
>

Ok, at least I guessed the right path :)

> Second obstacle: NameIDFormat only unspecified
> (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified), since in the past
> I had the same issue with the metadata provided to me at the time (with
> Google as SP) i fixed in the same way, could be a source of problems?
>
> It could, depending on application design.  Instead of changing the
> metadata to match your needs, it'd be best to configure your IdP to release
> the appropriate attribute as an unspecified NameID.
>

I tried but I suppose I forgot something:
I restored the original NameID in the metadata and then in
attribute-resolver.xml I put:
    <AttributeDefinition xsi:type="Simple" id="oneTrustNameID">
        <InputDataConnector ref="esLDAP" attributeNames="mail" />
        <AttributeEncoder xsi:type="SAML2String" name="ONE-TRUST-PRINCIPAL"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </AttributeDefinition>

in attribute-filter.xml I put:
    <AttributeFilterPolicy id="OneTrust">
        <PolicyRequirementRule xsi:type="Requester" value="
https://app-de.onetrust.com/saml2" />
        <AttributeRule attributeID="oneTrustNameID">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

in relying-party.xml I put:
        <bean parent="RelyingPartyByName" c:relyingPartyIds="
https://app-de.onetrust.com/saml2">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/>
                </list>
            </property>
        </bean>

and in saml-nameid.xml I put:
 <util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'oneTrustNameID'} }">
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="https://app-de.onetrust.com/saml2" />
            </property>
        </bean>

but I get this in the log: " Ignoring NameIDFormat metadata that includes
the 'unspecified' format"
2022-05-13 16:07:33,927 - 10.xx.xx.15 - INFO
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action
FinalizeAuthentication: Principal testuser authenticated
2022-05-13 16:07:34,460 - 10.xx.xx.15 - WARN
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:73]
- Ignoring NameIDFormat metadata that includes the 'unspecified' format
2022-05-13 16:07:34,905 - 10.xx.xx.15 - WARN
[org.opensaml.saml.common.binding.SAMLBindingSupport:94] - Relay state
exceeds 80 bytes:
ZW1haWw6cy5icmlkaUBlbmdpbnNvZnQuY29tJm9yaWdpbkhvc3Q6ZW5naW5zb2Z0Lm15Lm9uZXRydXN0LmNvbQ==

Could someone point me to what I am missing?

Thanks
Stefano
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220513/bc6a38a9/attachment.htm>