Ignoring NameIDFormat metadata that includes the 'unspecified' format

[izoret at cines.fr]

Hi ! 

I have to deploy an IDP shibboleth 4.3.1 wich confirm the authentification from an internal vendor Sp (lockself) to our internal OpenLdap. 

my IDP work, but on the process Log i've this : 
... 
192.168.2.21 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential Validator ldap: Login by 'izoret' succeeded 
2024-02-07 09:56:03,768 - 192.168.2.21 - INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action FinalizeAuthentication: Principal izoret authenticated 
2024-02-07 09:56:03,810 - 192.168.2.21 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:73] - Ignoring NameIDFormat metadata that includes the 'unspecified' format 
2024-02-07 09:56:03,942 - 192.168.2.21 - INFO [Shibboleth-Audit.SSO:338] - 192.168.2.21|2024-02-07T08:55:54.285864Z|2024-02-07T08:56:03.942227Z|izoret|https://multipass-preprod.cines.fr/saml2/metadata|_694228b2d6f1723031630733013f23da|password 
2024-02-07T08:56:03.765241Z|firstname,mail,Groups,lastname|AAdzZWNyZXQxuLy+bP7HP/+5R8j4vX/NO+BgvgWxnY7N9wRCUkc4Wmz8Xphquf3h6VeL2FYBk5tX5eQF+IZMgLl/xDiyjxFsIuS1bV9qSh8MY6CCskEaakBA3KUYHlYtDKnZimNxPy77ntU8KOrc3q0X5dZvCjAaSu86RDqmLA==|transient|false|true|AES128-GCM|Redirect|POST||Success||8550dcb21a9042fb2d2849e9ce48d99620065ad95c8e1d1ce3dad382cb303e24|Mozilla/5.0 (X11; Linux x86_64; rv:1 
... 


As specified here, 
[ https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration | https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration ] 

=> Dealing with "Unspecified" 

i'v try to understand the RelyngPartyConfiguration and MetadataDrivenConfiguration, without success .. 





On the SP , the test page give me this : 
---------------- 
attributes_sent_by_idp 
urn:oid:0.9.2342.19200300.100.1.3 
0: "izoret at cines.fr" 

urn:oid:2.5.4.4 
0: "izoret" 
urn:oid:2.5.4.42 
0 "philippe" 

urn:oid:1.3.6.1.1.1.1.1: 
0 "25501" 

upn_sent_by_idp"AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==" 


lockself_errors 

0: "'firstname' variable is required" 
1: "'lastname' variable is required" 
2: "'mail' variable is required. Can be skip if 'upn' is sent" 
3: "'groups' variable is missing. Maybe you doesn't want to use it" 
---------------- 

IDP seems doing the job, but not the SP. 


My "attribute-resolver.xml" 

<?xml version="1.0" encoding="UTF-8"?> 

<AttributeResolver 
xmlns="urn:mace:shibboleth:2.0:resolver" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"> 
<AttributeDefinition id="uid" xsi:type="PrincipalName" /> 


<AttributeDefinition id="mail" xsi:type="Template"> 
<InputAttributeDefinition ref="uid" /> 
<Template> 
<![CDATA[ 
${uid}@%{idp.scope} 
]]> 
</Template> 
</AttributeDefinition> 

<AttributeDefinition id="firstname" xsi:type="Simple"> 
<InputDataConnector ref="myLDAP" attributeNames="givenName"/> 
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" /> 
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" /> 
</AttributeDefinition> 

<AttributeDefinition id="lastname" xsi:type="Simple"> 
<InputDataConnector ref="myLDAP" attributeNames="sn"/> 
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" /> 
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" /> 
</AttributeDefinition> 

<AttributeDefinition id="Groups" xsi:type="Simple"> 
<InputDataConnector ref="myLDAP" attributeNames="gidNumber"/> 
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" /> 
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.1.1.1.1" friendlyName="gidNumber" encodeType="false" /> 
</AttributeDefinition> 


<DataConnector id="myLDAP" xsi:type="LDAPDirectory" 
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" 
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
principal="%{idp.attribute.resolver.LDAP.bindDN}" 
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}" 
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}" 
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"> 
<FilterTemplate> 
<![CDATA[ 
%{idp.attribute.resolver.LDAP.searchFilter} 
]]> 
</FilterTemplate> 
</DataConnector> 

</AttributeResolver> 



Could you help me on this topics, with exemple .. ? 

Best Regards, 


Philippe Izoret 

Centre Informatique de l'Enseignement Supérieur 
Département des Services Informatiques 
950 rue de Saint Priest 
34097 Montpellier cedex 5 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240207/1ce741af/attachment.htm>