Getting IdP attributes from proxy IdP

[Christopher Bongaarts]

On 2/2/2024 10:59 AM, Cantor, Scott wrote:
> Could be legacy issues if you haven't migrated to all of the new syntaxes, you can't combine approaches there. The flow descriptors from pre-4.1 days will totally supplant what the properties do (i.e. you'd have to remove them or use the XML syntax to add the supportedPrincipals setting).
>
> The other common mistake is missing commas, it's really easy because of that multi-line mess to overlook them not being there. The syntax is bad, but it was about the only way to make it work without XML.
>
> e.g. idp.authn.MFA.supportedPrincipals = \
> 	saml2/something, \
> 	saml1/something \
> 	saml2/somethingelse
>
> Looks fine but the last line won't be included correctly, the comma after the second one is missing.

Turns out it was even simpler than that - I was missing the protocol 
identifier (saml2/) in front of them.  The IdP even helpfully told me so 
in the logs if I had been looking closer:

2024-02-02 12:04:08,489 -  - ERROR 
[net.shibboleth.idp.authn.principal.PrincipalServiceManager:125] - No 
PrincipalService registered under ID 'https:'
2024-02-02 12:04:08,490 -  - ERROR 
[net.shibboleth.idp.authn.principal.PrincipalServiceManager:128] - 
Principal string was not in the expected format

So it's all working as expected now.  Thanks for the pointers as always!

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240202/4a05a9af/attachment.htm>