Persistent ID instead of Transient Name ID

[Melvin Lasky]

I think I got it. It was the copy and paste job. I fixed it.

Thanks everyone!

Mel

*Melvin Lasky*
*Associate Director of Enterprise Architecture*

Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu
www.manhattan.edu



On Wed, Jan 11, 2023 at 11:53 AM Melvin Lasky <melvin.lasky at manhattan.edu>
wrote:

> Ok re-working it. No need to change NameID to persistent. Just want to
> send them this opaque attribute identifier.
>
> When I added Dave's lines to my attribute-resolver.xml it's bombing out on
> starting
>
> shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,987 - ERROR
> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
> - Service 'shibboleth.AttributeRegistryService': Initial load failed
>
> shib-idp;idp-process.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 210 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
> 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
> character [children], because the type's content type is element-only.
>
> shib-idp;idp-process.log;dev;nothing; at
> net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)
>
> shib-idp;idp-process.log;dev;nothing;Caused by:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 210 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
> 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
> character [children], because the type's content type is element-only.
>
> shib-idp;idp-process.log;dev;nothing; at
> org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)
>
> shib-idp;idp-process.log;dev;nothing;Caused by:
> org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element
> 'AttributeDefinition' cannot have character [children], because the type's
> content type is element-only.
>
> shib-idp;idp-process.log;dev;nothing; at
> java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)
>
> shib-idp;idp-warn.log;dev;nothing;2023-01-11 16:47:16,987 - ERROR
> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
> - Service 'shibboleth.AttributeRegistryService': Initial load failed
>
> shib-idp;idp-warn.log;dev;nothing;net.shibboleth.utilities.java.support.service.ServiceException:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 210 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
> 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
> character [children], because the type's content type is element-only.
>
> shib-idp;idp-warn.log;dev;nothing; at
> net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:377)
>
> shib-idp;idp-warn.log;dev;nothing;Caused by:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
> 210 in XML document from file
> [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException; lineNumber: 210; columnNumber:
> 29; cvc-complex-type.2.3: Element 'AttributeDefinition' cannot have
> character [children], because the type's content type is element-only.
>
> shib-idp;idp-warn.log;dev;nothing; at
> org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:402)
>
> shib-idp;idp-warn.log;dev;nothing;Caused by:
> org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element
> 'AttributeDefinition' cannot have character [children], because the type's
> content type is element-only.
>
> shib-idp;idp-warn.log;dev;nothing; at
> java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)
>
> shib-idp;idp-process.log;dev;nothing; - []2023-01-11 16:47:16,995 - ERROR
> [net.shibboleth.utilities.java.support.service.AbstractReloadableService:185]
> - Service 'shibboleth.AttributeRegistryService': No further attempts will
> be made to reload
>
> Line 210 is:
>
> 206: <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"
> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
>
> 207: <InputDataConnector ref="computedID" attributeNames="computedID" />
>
> 208: <AttributeEncoder xsi:type="SAML1XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
>
> 209: <AttributeEncoder xsi:type="SAML2XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
> />
>
> 210: </AttributeDefinition>
>
> I did fix my data connector for my attribute, and changed the salt to
> random characters
>
> 318 <DataConnector xsi:type="ComputedId"
>
> 319 id="computedID"
>
> 320 generatedAttributeID="computedID"
>
> 321 salt="Some Random Characters">
>
> 322 <InputDataConnector ref="myLDAP" attributeNames="uid" />
>
> 323 </DataConnector>
>
> Any ideas what's going on here?
>
> Thanks
>
> *Melvin Lasky*
> *Associate Director of Enterprise Architecture*
>
> Riverdale, NY 10471
> Phone: 718-862-7410
> melvin.lasky at manhattan.edu
> www.manhattan.edu
>
>
>
> On Wed, Jan 11, 2023 at 11:45 AM Cantor, Scott via users <
> users at shibboleth.net> wrote:
>
>> > Regarding the SP metadata, you MAY have to delete the "unspecified"
>> line. My
>> > IdP tends to resolve to whatever it wants when "unspecified" is in the
>> SP
>> > metadata.
>>
>> That would only happen if you explicitly configured support for it in
>> your IdP, otherwise we ignore it (and we definitely ignore it when an SP
>> requests it explicitly).
>>
>> This is one of those "don't support this, ever" things that I tell people
>> and they frequently just aren't willing to push back or understand that
>> when vendors say they want that, they don't mean it (and don't care if you
>> use it or not).
>>
>> I can think of maybe 1-2 non-Shib SP cases I've ever seen where an SP
>> even checks or notices the Format of a NameID, just one of thoese
>> completely broken things that became common because people are lazy (and
>> lazy -> broken when you support security specs).
>>
>> -- Scott
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/fa906100/attachment.htm>