Invalid NameIDPolicy Issue

[Alberto DeAngelis]

Thanks David, that fixed it!

Alberto

On Fri, Mar 22, 2024 at 11:01 AM db--- via users <users at shibboleth.net>
wrote:

> Your policy indicates use of mail attribute for nameId, but your attribute
> release only has employeeNumber, so there’s no way to build or use the
> required nameId.
> May not be the only issue, but that needs remedy.
> Given the “ellucian” reference you probably need the employeeNumber in the
> nameId, not ‘mail.’
>
> David.Bantz at Alaska.edu
>
>
> On Mar 22, 2024, at 06:49, Alberto DeAngelis via users <
> users at shibboleth.net> wrote:
>
> 
> Hi Everyone,
>
> I am running into this issue setting up SSO for Ellucian Experience:
>
> shib-idp;idp-warn.log;dev;nothing;2024-03-22 13:54:34,540 - WARN
> [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event
> occurred while processing the request: InvalidNameIDPolicy
> shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2024-03-22
> 13:56:16,226 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A
> non-proceed event occurred while processing the request: InvalidNameIDPolicy
>
> This is what we have for our relying party configuration:
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="ellucian-experience">
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> />
>                 </list>
>             </property>
>         </bean>
>
> This is our saml-nameid.xml configuration:
>
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>  p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>            p:attributeSourceIds="#{ {'mail'} }" >
>            <property name="activationCondition" >
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidate="ellucian-experience" />
>            </property>
>        </bean>
>
> This is our attribute-filter.xml configuration:
>
> <AttributeFilterPolicy id="releaseForEllucianExp" >
>   <PolicyRequirementRule xsi:type="Requester" value="ellucian-experience"
> />
>   <AttributeRule attributeID="employeeNumber">
>     <PermitValueRule xsi:type="ANY" />
>   </AttributeRule>
> </AttributeFilterPolicy>
>
> I am not sure what else to check.
>
> I appreciate your help with this.
>
> Alberto
>
>
> --
> Alberto DeAngelis '20 '22
>
> *JrDatabaseAdmin/IT Dept.Information Technology Services*
> [image: Manhattan College Logo/Shield]
> Riverdale, NY 10471
> adeangelis01 at manhattan.edu
> www.manhattan.edu
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Alberto DeAngelis '20 '22

*JrDatabaseAdmin/IT Dept.Information Technology Services*
[image: Manhattan College Logo/Shield]
Riverdale, NY 10471
adeangelis01 at manhattan.edu
www.manhattan.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240322/dd81e16a/attachment.htm>