Ignoring NameIDFormat metadata that includes the 'unspecified' format

[Nate Klingenstein]

> Thanks for your reply,

Of course!

> For one field ("mail") , i'v relase/comment the call on my attribute-resolver.xml (it's the right thing ?)
> so for the moment i want test with only mail ..

I assume this is uncommented in your actual resolver, or it would certainly be your problem.

> <!--
>    <AttributeDefinition id="mail" xsi:type="Template">
>         <InputAttributeDefinition ref="uid" />
>         <Template>
>           <![CDATA[
>                ${uid}@%{idp.scope}
>           ]]>
>         </Template>
>     </AttributeDefinition>
> -->
> --
> 
> And add this 2 beans at the end of saml-nameid.xml


> <!-- SAML 2 NameID Generation -->
>     <util:list id="shibboleth.SAML2NameIDGenerators">
>         <ref bean="shibboleth.SAML2TransientGenerator" />
>         <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
>         <!--   <ref bean="shibboleth.SAML2PersistentGenerator" />  -->
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:omitQualifiers="true"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'mail'} }" />
>     </util:list>
> 
>     <!-- SAML 1 NameIdentifier Generation -->
>     <util:list id="shibboleth.SAML1NameIdentifierGenerators">
>         <ref bean="shibboleth.SAML1TransientGenerator" />
>         <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
>             p:omitQualifiers="true"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'mail'} }" />
>     </util:list>

These are fine, but they don’t define an encoder for unspecified. The end of the format strings is emailAddress instead. If your application is requesting unspecified, you’ll want to fix that.

> after uncomment this on saml-nameid.properties :
> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
> 
> If on saml-nameid.xml
> i uncomment the ref bean : <ref bean="shibboleth.SAML2PersistentGenerator" /> 
> 
> 
> 2024-02-07 15:58:52,810 -  - WARN [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:591] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2NameIDGenerators': Cannot resolve reference to bean 'shibboleth.SAML2PersistentGenerator' while setting bean property 'sourceList' with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Cannot resolve reference to bean '#{'shibboleth.ComputedPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdStore'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.ComputedPersistentIdGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Global salt and salt lookup strategy cannot both be null

You’ll need to set up a salt before you can use persistent ID’s, but that’s orthogonal to the apparent issue. The other errors are derived from this one, but again, not directly relevant. I would ignore persistent ID’s for now.

> upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==“ 
> Wich logs can i give you  ..  Sp Logs ? IDP Logs ?

We need the IdP’s logs on DEBUG. It will explain exactly why it is unable or unwilling to generate an unspecified NameID.

Best regards,
Nate
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240207/38e8f4c1/attachment.htm>