Shibboleth 4.2.1. Identity Provider and OneTrust (SP)

[Nate Klingenstein]

Stefano,

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration#Dealing-with-%22Unspecified%22

Thanks for the intel on widespread manual key importing,
Nate

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Stefano Bridi
Sent: Friday, May 13 2022, 2:19 pm
To: Shib Users
Subject: Re: Shibboleth 4.2.1. Identity Provider and OneTrust (SP)

On Fri, May 13, 2022 at 1:19 PM Nate Klingenstein <ndk at signet.id <mailto:ndk at signet.id>> wrot

Thanks Nate,

No.  Shibboleth only loads certificates from provider metadata.

Ok, at least I guessed the right path :)

> Second obstacle: NameIDFormat only unspecified (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified), since in the past I had the same issue with the metadata provided to me at the time (with Google as SP) i fixed in the same way, could be a source of problems?

It could, depending on application design.  Instead of changing the metadata to match your needs, it'd be best to configure your IdP to release the appropriate attribute as an unspecified NameID.

I tried but I suppose I forgot something:

I restored the original NameID in the metadata and then in attribute-resolver.xml I put:

    <AttributeDefinition xsi:type="Simple" id="oneTrustNameID">
        <InputDataConnector ref="esLDAP" attributeNames="mail" />
        <AttributeEncoder xsi:type="SAML2String" name="ONE-TRUST-PRINCIPAL" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </AttributeDefinition>

in attribute-filter.xml I put:

    <AttributeFilterPolicy id="OneTrust">
        <PolicyRequirementRule xsi:type="Requester" value="https://app-de.onetrust.com/saml2 <https://app-de.onetrust.com/saml2>" />
        <AttributeRule attributeID="oneTrustNameID">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

in relying-party.xml I put:

        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://app-de.onetrust.com/saml2 <https://app-de.onetrust.com/saml2>">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
                </list>
            </property>
        </bean>

and in saml-nameid.xml I put:

 <util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'oneTrustNameID'} }">
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://app-de.onetrust.com/saml2 <https://app-de.onetrust.com/saml2>" />
            </property>
        </bean>

but I get this in the log: " Ignoring NameIDFormat metadata that includes the 'unspecified' format"

2022-05-13 16:07:33,927 - 10.xx.xx.15 - INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action FinalizeAuthentication: Principal testuser authenticated
2022-05-13 16:07:34,460 - 10.xx.xx.15 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:73] - Ignoring NameIDFormat metadata that includes the 'unspecified' format
2022-05-13 16:07:34,905 - 10.xx.xx.15 - WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:94] - Relay state exceeds 80 bytes: ZW1haWw6cy5icmlkaUBlbmdpbnNvZnQuY29tJm9yaWdpbkhvc3Q6ZW5naW5zb2Z0Lm15Lm9uZXRydXN0LmNvbQ==

Could someone point me to what I am missing?

Thanks

Stefano

--

For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net