Ignoring NameIDFormat metadata that includes the 'unspecified' format

[izoret at cines.fr]

Hello Nate, 



In the attribute-resolver.xml the definition for mail attribute is uncommented. 
=> 
<AttributeDefinition id="mail" xsi:type="Template"> 
<InputAttributeDefinition ref="uid" /> 
<Template> 
<![CDATA[ 
${uid}@%{idp.scope} 
]]> 
</Template> 
</AttributeDefinition> 

Now, on the saml-nameid.xml , i define an encoder for unspecified attribute request by SP. 
=> 
<util:list id="shibboleth.SAML2NameIDGenerators"> 
<ref bean="shibboleth.SAML2TransientGenerator" /> 
<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> 
<!-- 
<ref bean="shibboleth.SAML2PersistentGenerator" /> 
--> 
<bean parent="shibboleth.SAML2AttributeSourcedGenerator" 
p:omitQualifiers="true" 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" 
p:attributeSourceIds="#{ {'mail'} }" /> 
<!-- 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" 
--> 
</util:list> 

<!-- SAML 1 NameIdentifier Generation --> 
<util:list id="shibboleth.SAML1NameIdentifierGenerators"> 
<ref bean="shibboleth.SAML1TransientGenerator" /> 
<bean parent="shibboleth.SAML1AttributeSourcedGenerator" 
p:omitQualifiers="true" 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" 
p:attributeSourceIds="#{ {'mail'} }" /> 
</util:list> 

After restart tomcat, always the same problem : priori, Idp send the attribute but not as Sp want to receive .. (sorry for my english .) 

=> lockself_errors : 2: "'mail' variable is required ... 
---------------- 
attributes_sent_by_idp 

urn:oid:2.5.4.4 
0: "izoret" 
urn:oid:2.5.4.42 
0 "philippe" 

urn:oid:1.3.6.1.1.1.1.1: 
0 "25501" 

upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==" 


lockself_errors 

0: "'firstname' variable is required" 
1: "'lastname' variable is required" 
2: "'mail' variable is required. Can be skip if 'upn' is sent" 
3: "'groups' variable is missing. Maybe you doesn't want to use it" 
----------- 

My LOG conf : 
<variable name="idp.loglevel.idp" value="${idp.loglevel.idp:-DEBUG}" /> 
<variable name="idp.loglevel.ldap" value="${idp.loglevel.ldap:-WARN}" /> 
<variable name="idp.loglevel.messages" value="${idp.loglevel.messages:-DEBUG}" /> 
<variable name="idp.loglevel.encryption" value="${idp.loglevel.encryption:-INFO}" /> 
<variable name="idp.loglevel.opensaml" value="${idp.loglevel.opensaml:-DEBUG}" /> 
<variable name="idp.loglevel.props" value="${idp.loglevel.props:-INFO}" /> 
<variable name="idp.loglevel.httpclient" value="${idp.loglevel.httpclient:-INFO}" /> 

The Log on DEBUG mode : (it's Huge ..) and it refuse by moderator on a precedent mail .. 

Can send the log via attachment ? 

Regards, 

Philippe 


De: "Nate Klingenstein" <ndk at sudonym.me> 
À: "Shib Users" <users at shibboleth.net> 
Envoyé: Mercredi 7 Février 2024 16:42:23 
Objet: Re: Ignoring NameIDFormat metadata that includes the 'unspecified' format 




Thanks for your reply, 




Of course! 


BQ_BEGIN

For one field ("mail") , i'v relase/comment the call on my attribute-resolver.xml (it's the right thing ?) 
so for the moment i want test with only mail .. 

BQ_END

I assume this is uncommented in your actual resolver, or it would certainly be your problem. 


BQ_BEGIN

<!-- 
<AttributeDefinition id="mail" xsi:type="Template"> 
<InputAttributeDefinition ref="uid" /> 
<Template> 
<![CDATA[ 
${uid}@%{idp.scope} 
]]> 
</Template> 
</AttributeDefinition> 
--> 
-- 

And add this 2 beans at the end of saml-nameid.xml 

BQ_END



BQ_BEGIN

<!-- SAML 2 NameID Generation --> 
<util:list id="shibboleth.SAML2NameIDGenerators"> 
<ref bean="shibboleth.SAML2TransientGenerator" /> 
<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> 
<!-- <ref bean="shibboleth.SAML2PersistentGenerator" /> --> 
<bean parent="shibboleth.SAML2AttributeSourcedGenerator" 
p:omitQualifiers="true" 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" 
p:attributeSourceIds="#{ {'mail'} }" /> 
</util:list> 

<!-- SAML 1 NameIdentifier Generation --> 
<util:list id="shibboleth.SAML1NameIdentifierGenerators"> 
<ref bean="shibboleth.SAML1TransientGenerator" /> 
<bean parent="shibboleth.SAML1AttributeSourcedGenerator" 
p:omitQualifiers="true" 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" 
p:attributeSourceIds="#{ {'mail'} }" /> 
</util:list> 

BQ_END

These are fine, but they don’t define an encoder for unspecified. The end of the format strings is emailAddress instead. If your application is requesting unspecified, you’ll want to fix that. 


BQ_BEGIN

after uncomment this on saml-nameid.properties : 
idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient 

If on saml-nameid.xml 
i uncomment the ref bean : <ref bean="shibboleth.SAML2PersistentGenerator" /> 


2024-02-07 15:58:52,810 - - WARN [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:591] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2NameIDGenerators': Cannot resolve reference to bean 'shibboleth.SAML2PersistentGenerator' while setting bean property 'sourceList' with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Cannot resolve reference to bean '#{'shibboleth.ComputedPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdStore'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.ComputedPersistentIdGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Global salt and salt lookup strategy cannot both be null 

BQ_END

You’ll need to set up a salt before you can use persistent ID’s, but that’s orthogonal to the apparent issue. The other errors are derived from this one, but again, not directly relevant. I would ignore persistent ID’s for now. 


BQ_BEGIN

upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==“ 

BQ_END

BQ_BEGIN

Wich logs can i give you  ..  Sp Logs ? IDP Logs ? 

BQ_END

We need the IdP’s logs on DEBUG. It will explain exactly why it is unable or unwilling to generate an unspecified NameID. 

Best regards, 
Nate 

-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240208/b805c978/attachment.htm>