Invalid NameIDPolicy Issue

[Michael Grady]

You have to release the attribute (mail) that you want to base the NameID on.

p.s. You actually almost never need activation conditions in saml-nameid.xml, that will just cause you more work in the future if you have to similarly send some other service that emailAddress NameID format. And you probably don't need a relying party override either, because you could just be sure you have a NameIDFormat element in the local metadata you have for the service that specifies that format. Lots of people cause themselves extra work by thinking they need relying party overrides and activation conditions to manage NameIDs, when most of the time neither are needed.

> On Mar 22, 2024, at 9:49 AM, Alberto DeAngelis via users <users at shibboleth.net> wrote:
> 
> Hi Everyone,
> 
> I am running into this issue setting up SSO for Ellucian Experience:
> 
> shib-idp;idp-warn.log;dev;nothing;2024-03-22 13:54:34,540 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy
> shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2024-03-22 13:56:16,226 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy
> 
> This is what we have for our relying party configuration:
> 
> <bean parent="RelyingPartyByName" c:relyingPartyIds="ellucian-experience">
>             <property name="profileConfigurations"> 
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>                 </list>
>             </property>
>         </bean>
> 
> This is our saml-nameid.xml configuration:
> 
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>            p:attributeSourceIds="#{ {'mail'} }" >
>            <property name="activationCondition" >
>                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="ellucian-experience" />
>            </property>
>        </bean>
> 
> This is our attribute-filter.xml configuration:
> 
> <AttributeFilterPolicy id="releaseForEllucianExp" >
>   <PolicyRequirementRule xsi:type="Requester" value="ellucian-experience" />
>   <AttributeRule attributeID="employeeNumber">
>     <PermitValueRule xsi:type="ANY" />
>   </AttributeRule>
> </AttributeFilterPolicy>
> 
> I am not sure what else to check.
> 
> I appreciate your help with this.
> 
> Alberto
> 
> 
> -- 
> Alberto DeAngelis '20 '22
> JrDatabaseAdmin/IT Dept.
> Information Technology Services
> 
> Riverdale, NY 10471
> adeangelis01 at manhattan.edu <mailto:adeangelis01 at manhattan.edu>
> www.manhattan.edu <http://www.manhattan.edu/>
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240322/0913488e/attachment.htm>