Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-09 01:23 CEST]:
> However, the problem I am seeing is that the SAMLResponse does not have a
> User/Subject/NameID in it, which then causes the COTS IdP to throw an error
> ("no user found").
> 
> From what I have been able to figure out, I realized that this is because I
> have not modified the attribute-resolver and the saml-name-id configuration
> in the Shibboleth IdP yet.

Correct. Without those (attributes much more than NameIDs) your IDP
will be pretty useless.

> Besides errors with the XML files

If you want help with those you'll need to be more specific.

> I was seeing errors in the idp-warn.log about missing certificate
> (.crt) files, even though I have TLS set to 'false' in the
> ldap.properties file.

The IDP does not perform TLS, that's the job of the Java container
(Jetty, Tomcat) acting as web server -- or yet another web server in
front of that.
Also the IDP installier creates all the certificates and keys and
keystores and whatnot that an installation would need. So it's not
clear how somthing that's required would be missing. Again, you'll
need to be more specific.

> One other potential problem is that I noticed that in the OpenDJ
> schema, the email attribute is literally named 'emailAddress',
> rather than 'mail'.

You'll have to read the attribute resolver documentation.
(The IDP can take arbitrarily named attribute from data sources, call
them by arbitrary internal names throughout its own configuration and
then assert them as arbitrarily named SAML Attributes or NameIDs as
needed.)
While you're at it also read the attribute registry documentation.

> 1) Re. the certificate/.crt errors:  As mentioned, the LDAP server is not
> SSL-enabled, and in the ldap.properties, I had set the StartTLS parameter
> to 'false'.  It seems like even if I do that, the IdP is looking for the
> .crt file.  Do I need to comment out all of the properties that are related
> to SSL (the truststore ones, etc)?

Possibly, yes. The config may default to secure, meaning it's the ones
running things in an insecure way that will have to do the work to
become insecure, not the other way around.
Besides (or even instead!) your ldap.properties also have a look a the
defaut "MyLDAP" Data Connector which besides a few TLS options (which
can be turned off in your ldap.properties) also includes this:
  trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
You'd have to remove that line from that data connector.

> 2) Re. the attribute-resolver and the name id, is there maybe minimal
> versions of those that would work for an LDAP server?

The default config works even without an LDAP server and the IDP
should also include a few example files for working with LDAP
servers.

Best reagrds,
-peter