Ignoring NameIDFormat metadata that includes the 'unspecified' format
Nate Klingenstein
ndk at sudonym.me
Thu Feb 8 13:34:58 UTC 2024
Philippe,
You can send the logs via attachment directly to me if you like. Just raise the main IdP log level to DEBUG and send me the excerpt of one failed transaction. I don’t need to see everything.
I’ll post the resolution on-list.
Cheers,
Nate
> On Feb 8, 2024, at 6:22 AM, izoret at cines.fr wrote:
>
>
> Hello Nate,
>
>
>
> In the attribute-resolver.xml the definition for mail attribute is uncommented.
> =>
> <AttributeDefinition id="mail" xsi:type="Template">
> <InputAttributeDefinition ref="uid" />
> <Template>
> <![CDATA[
> ${uid}@%{idp.scope}
> ]]>
> </Template>
> </AttributeDefinition>
>
> Now, on the saml-nameid.xml , i define an encoder for unspecified attribute request by SP.
> =>
> <util:list id="shibboleth.SAML2NameIDGenerators">
> <ref bean="shibboleth.SAML2TransientGenerator" />
> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
> <!--
> <ref bean="shibboleth.SAML2PersistentGenerator" />
> -->
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> p:omitQualifiers="true"
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> p:attributeSourceIds="#{ {'mail'} }" />
> <!--
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> -->
> </util:list>
>
> <!-- SAML 1 NameIdentifier Generation -->
> <util:list id="shibboleth.SAML1NameIdentifierGenerators">
> <ref bean="shibboleth.SAML1TransientGenerator" />
> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
> p:omitQualifiers="true"
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> p:attributeSourceIds="#{ {'mail'} }" />
> </util:list>
>
> After restart tomcat, always the same problem : priori, Idp send the attribute but not as Sp want to receive .. (sorry for my english .)
>
> => lockself_errors : 2: "'mail' variable is required ...
> ----------------
> attributes_sent_by_idp
>
> urn:oid:2.5.4.4
> 0: "izoret"
> urn:oid:2.5.4.42
> 0 "philippe"
>
> urn:oid:1.3.6.1.1.1.1.1:
> 0 "25501"
>
> upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w=="
>
>
> lockself_errors
>
> 0: "'firstname' variable is required"
> 1: "'lastname' variable is required"
> 2: "'mail' variable is required. Can be skip if 'upn' is sent"
> 3: "'groups' variable is missing. Maybe you doesn't want to use it"
> -----------
>
> My LOG conf :
> <variable name="idp.loglevel.idp" value="${idp.loglevel.idp:-DEBUG}" />
> <variable name="idp.loglevel.ldap" value="${idp.loglevel.ldap:-WARN}" />
> <variable name="idp.loglevel.messages" value="${idp.loglevel.messages:-DEBUG}" />
> <variable name="idp.loglevel.encryption" value="${idp.loglevel.encryption:-INFO}" />
> <variable name="idp.loglevel.opensaml" value="${idp.loglevel.opensaml:-DEBUG}" />
> <variable name="idp.loglevel.props" value="${idp.loglevel.props:-INFO}" />
> <variable name="idp.loglevel.httpclient" value="${idp.loglevel.httpclient:-INFO}" />
>
> The Log on DEBUG mode : (it's Huge ..) and it refuse by moderator on a precedent mail ..
>
> Can send the log via attachment ?
>
> Regards,
>
> Philippe
>
> De: "Nate Klingenstein" <ndk at sudonym.me>
> À: "Shib Users" <users at shibboleth.net>
> Envoyé: Mercredi 7 Février 2024 16:42:23
> Objet: Re: Ignoring NameIDFormat metadata that includes the 'unspecified' format
>
> Thanks for your reply,
>
> Of course!
>
> For one field ("mail") , i'v relase/comment the call on my attribute-resolver.xml (it's the right thing ?)
> so for the moment i want test with only mail ..
>
> I assume this is uncommented in your actual resolver, or it would certainly be your problem.
>
> <!--
> <AttributeDefinition id="mail" xsi:type="Template">
> <InputAttributeDefinition ref="uid" />
> <Template>
> <![CDATA[
> ${uid}@%{idp.scope}
> ]]>
> </Template>
> </AttributeDefinition>
> -->
> --
>
> And add this 2 beans at the end of saml-nameid.xml
>
>
> <!-- SAML 2 NameID Generation -->
> <util:list id="shibboleth.SAML2NameIDGenerators">
> <ref bean="shibboleth.SAML2TransientGenerator" />
> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
> <!-- <ref bean="shibboleth.SAML2PersistentGenerator" /> -->
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> p:omitQualifiers="true"
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> p:attributeSourceIds="#{ {'mail'} }" />
> </util:list>
>
> <!-- SAML 1 NameIdentifier Generation -->
> <util:list id="shibboleth.SAML1NameIdentifierGenerators">
> <ref bean="shibboleth.SAML1TransientGenerator" />
> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
> p:omitQualifiers="true"
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> p:attributeSourceIds="#{ {'mail'} }" />
> </util:list>
>
> These are fine, but they don’t define an encoder for unspecified. The end of the format strings is emailAddress instead. If your application is requesting unspecified, you’ll want to fix that.
>
> after uncomment this on saml-nameid.properties :
> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
>
> If on saml-nameid.xml
> i uncomment the ref bean : <ref bean="shibboleth.SAML2PersistentGenerator" />
>
>
> 2024-02-07 15:58:52,810 - - WARN [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:591] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2NameIDGenerators': Cannot resolve reference to bean 'shibboleth.SAML2PersistentGenerator' while setting bean property 'sourceList' with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Cannot resolve reference to bean '#{'shibboleth.ComputedPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdStore'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.ComputedPersistentIdGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Global salt and salt lookup strategy cannot both be null
>
> You’ll need to set up a salt before you can use persistent ID’s, but that’s orthogonal to the apparent issue. The other errors are derived from this one, but again, not directly relevant. I would ignore persistent ID’s for now.
>
> upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==“
> Wich logs can i give you .. Sp Logs ? IDP Logs ?
>
> We need the IdP’s logs on DEBUG. It will explain exactly why it is unable or unwilling to generate an unspecified NameID.
>
> Best regards,
> Nate
>
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240208/71936676/attachment.htm>
More information about the users
mailing list