Persistent ID instead of Transient Name ID

Wed Jan 11 16:53:57 UTC 2023

Ok re-working it. No need to change NameID to persistent. Just want to send
them this opaque attribute identifier.

When I added Dave's lines to my attribute-resolver.xml it's bombing out on
starting

shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,987 - ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
- Service 'shibboleth.AttributeRegistryService': Initial load failed

shib-idp;idp-process.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
210 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
character [children], because the type's content type is element-only.

shib-idp;idp-process.log;dev;nothing; at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)

shib-idp;idp-process.log;dev;nothing;Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
210 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
character [children], because the type's content type is element-only.

shib-idp;idp-process.log;dev;nothing; at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)

shib-idp;idp-process.log;dev;nothing;Caused by:
org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element
'AttributeDefinition' cannot have character [children], because the type's
content type is element-only.

shib-idp;idp-process.log;dev;nothing; at
java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)

shib-idp;idp-warn.log;dev;nothing;2023-01-11 16:47:16,987 - ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
- Service 'shibboleth.AttributeRegistryService': Initial load failed

shib-idp;idp-warn.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
210 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
character [children], because the type's content type is element-only.

shib-idp;idp-warn.log;dev;nothing; at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)

shib-idp;idp-warn.log;dev;nothing;Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
210 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
character [children], because the type's content type is element-only.

shib-idp;idp-warn.log;dev;nothing; at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)

shib-idp;idp-warn.log;dev;nothing;Caused by: org.xml.sax.SAXParseException:
cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have character
[children], because the type's content type is element-only.

shib-idp;idp-warn.log;dev;nothing; at
java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)

shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,995 - ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:185]
- Service 'shibboleth.AttributeRegistryService': No further attempts will
be made to reload

Line 210 is:

206: <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">

207: <InputDataConnector ref="computedID" attributeNames="computedID" />

208: <AttributeEncoder xsi:type="SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />

209: <AttributeEncoder xsi:type="SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
/>

210: </AttributeDefinition>

I did fix my data connector for my attribute, and changed the salt to
random characters

318 <DataConnector xsi:type="ComputedId"

319 id="computedID"

320 generatedAttributeID="computedID"

321 salt="Some Random Characters">

322 <InputDataConnector ref="myLDAP" attributeNames="uid" />

323 </DataConnector>

Any ideas what's going on here?

Thanks

*Melvin Lasky*
*Associate Director of Enterprise Architecture*

Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu
www.manhattan.edu

On Wed, Jan 11, 2023 at 11:45 AM Cantor, Scott via users <
users at shibboleth.net> wrote:

> > Regarding the SP metadata, you MAY have to delete the "unspecified"
> line. My
> > IdP tends to resolve to whatever it wants when "unspecified" is in the SP
> > metadata.
>
> That would only happen if you explicitly configured support for it in your
> IdP, otherwise we ignore it (and we definitely ignore it when an SP
> requests it explicitly).
>
> This is one of those "don't support this, ever" things that I tell people
> and they frequently just aren't willing to push back or understand that
> when vendors say they want that, they don't mean it (and don't care if you
> use it or not).
>
> I can think of maybe 1-2 non-Shib SP cases I've ever seen where an SP even
> checks or notices the Format of a NameID, just one of thoese completely
> broken things that became common because people are lazy (and lazy ->
> broken when you support security specs).
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/242a0e44/attachment.htm>