Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

Hi,

I now have Shibboleth V5.1.4 partially working with an OpenDJ LDAP
instance.  By "partially working", I mean that the Hello World app works
and I can authenticate against users in the LDAP server (FYI, the
connection to the LDAP server is non-SSL).

I have also been able to get it connected to another IdP (a COTS IdP), so I
have:

COTS IdP ==> Shibboleth IdP. ==> OpenDJ LDAP server

Similar to Shibboleth, I think the COTS IdP has a kind of built-in SP, that
allows me to test authentication to the Shibboleth IdP (and the LDAP), and
it causes an AuthnRequest to be sent to the Shibboleth IdP and then the
Shibboleth IdP send a SamlResponse.

However, the problem I am seeing is that the SAMLResponse does not have a
User/Subject/NameID in it, which then causes the COTS IdP to throw an error
("no user found").

>From what I have been able to figure out, I realized that this is because I
have not modified the attribute-resolver and the saml-name-id configuration
in the Shibboleth IdP yet.

I've been trying to get those configured, but, unfortunately, my attempts
to make those configuration changes led to the point that I crashed the
Shibboleth IdP and it wouldn't start.

Besides errors with the XML files, I was seeing errors in the idp-warn.log
about missing certificate (.crt) files, even though I have TLS set to
'false' in the ldap.properties file.  One other potential problem is that I
noticed that in the OpenDJ schema, the email attribute is literally named
'emailAddress', rather than 'mail'.

Luckily, I had backed up the Shibboleth IdP files that I had changed, so I
was able to get the environment back to the point that the Shibboleth IdP
is starting/running again, albeit with the SAMLResponse still missing the
NameID again.

At this point, I have some questions that I hope that I can get some help
with.

1) Re. the certificate/.crt errors:  As mentioned, the LDAP server is not
SSL-enabled, and in the ldap.properties, I had set the StartTLS parameter
to 'false'.  It seems like even if I do that, the IdP is looking for the
.crt file.  Do I need to comment out all of the properties that are related
to SSL (the truststore ones, etc)?
2) Re. the attribute-resolver and the name id, is there maybe minimal
versions of those that would work for an LDAP server?

My apologies, but I HAVE been reading the documentation about
attribute-resolver and saml-name-id, and am having a hard time
understanding a lot of it.

Thanks in advance,
Jim









<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250408/42cde941/attachment.htm>