Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing
o haya
ohaya1001 at gmail.com
Thu Apr 10 07:58:03 UTC 2025
Hi Peter,
I made changes to the attribute-resolver.xml (I think) but I also had to
remove an additional line,
"useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}" from that
file, otherwise the IdP was failing to start.
Here's the current attribute-resolver.xml:
<?xml version="1.0" encoding="UTF-8"?>
> <!--
> This file is a rudimentary example. While it is semi-functional, it isn't
> very
> interesting. It is here only as a starting point for your deployment
> process
> to avoid any dependency on components like an LDAP directory.
>
> Very few attribute definitions and data connectors are demonstrated, and
> the
> data is derived statically from the logged-in username and a static example
> connector.
>
> The file(s) in the examples directory contain more examples that involve
> more
> complex approaches. Deployers should refer to the documentation for a
> complete
> list of possible components and their options.
> -->
> <AttributeResolver
> xmlns="urn:mace:shibboleth:2.0:resolver"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver
> http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
>
>
> <!-- ========================================== -->
> <!-- Attribute Definitions -->
> <!-- ========================================== -->
>
> <!--
> The EPPN is the "standard" federated username in higher ed.
> For guidelines on the implementation of this attribute, refer
> to the Shibboleth and eduPerson documentation. Above all, do
> not expose a value for this attribute without considering the
> long term implications.
> -->
> <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped"
> scope="%{idp.scope}">
> <InputAttributeDefinition ref="uid" />
> </AttributeDefinition>
>
> <!--
> The uid is the closest thing to a "standard" LDAP attribute
> representing a local username, but you should generally *never*
> expose uid to federated services, as it is rarely globally unique.
> -->
> <AttributeDefinition id="uid" xsi:type="PrincipalName" />
>
> <!--
> In the rest of the world, the email address is the standard identifier,
> despite the problems with that practice. Consider making the EPPN
> value the same as your official email addresses whenever possible.
> -->
> <AttributeDefinition id="mail" xsi:type="Template">
> <InputAttributeDefinition ref="uid" />
> <Template>
> <![CDATA[
> ${uid}@example.org
> ]]>
> </Template>
> </AttributeDefinition>
>
> <!--
> This is an example of an attribute sourced from a data connector.
> -->
> <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped"
> scope="%{idp.scope}">
> <InputDataConnector ref="myLDAP" attributeNames="affiliation" />
> </AttributeDefinition>
>
>
> <!-- ========================================== -->
> <!-- Data Connectors -->
> <!-- ========================================== -->
>
> <!-- Example LDAP Connector -->
>
> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
> principal="%{idp.attribute.resolver.LDAP.bindDN}"
>
> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
> startTLSTimeout="%{idp.attribute.resolver.LDAP.startTLSTimeout}"
> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
>
> connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
> noResultIsError="true"
> multipleResultsIsError="true"
> excludeResolutionPhases="c14n/attribute"
> exportAttributes="mail displayName sn givenName departmentNumber
> employeeNumber eduPersonEntitlement eduPersonAssurance">
> <FilterTemplate>
> <![CDATA[
> %{idp.attribute.resolver.LDAP.searchFilter}
> ]]>
> </FilterTemplate>
> <ConnectionPool
> minPoolSize="%{idp.pool.LDAP.minSize:3}"
> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
>
> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
> validateDN="%{idp.pool.LDAP.validateDN:}"
> validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
>
> validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
> prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/>
> </DataConnector>
>
> </AttributeResolver>
However, I am still getting no nameid in the SAMLResponse message when I
test :( ....
I was checking a bunch of other things, and was comparing to some
Shibboleth IdP metadata that I found by googling, e.g., UNC's IdP metadata,
and I was looking at the metadata from my Shibboleth IdP, and I noticed
that there are no " NameIDFormat" stanzas in the IdP metadata? (There is
also no " ArtifactResolutionService" stanza either).
FYI, originally/earlier, I ran the Shibboleth IdP install script, and I did
not do anything additional to that metadata file after that.
Was I supposed to manually add the NameIDFormat stanzas to the IdP metadata
that got produced by the install script?
FYI, here is why my Shibboleth IdP metadata looks like currently:
<!--
> This is example metadata only. Do *NOT* supply it as is without review,
> and do *NOT* provide it in real time to your partners.
> This metadata is not dynamic - it will not change as your configuration
> changes.
> On Demand Metadata Generation available from the metadatagen plugin.
> -->
> <md:EntityDescriptor entityID="https://idp01.xxxx.com/idp/shibboleth"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
> xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="
> http://www.w3.org/2000/09/xmldsig#">
> <md:IDPSSODescriptor
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
> <md:Extensions>
> <shibmd:Scope regexp="false">xxxx.com</shibmd:Scope>
> <mdui:UIInfo>
> <mdui:DisplayName xml:lang="en">A name for the IdP at
> idp01.xxxx.com</mdui:DisplayName>
> <mdui:Description xml:lang="en">Enter a description for
> the IdP at idp01.xxxx.com</mdui:Description>
> <mdui:Logo xml:lang="en" width="80" height="80">
> https://idp01.xxxx.com/path/to/logo.png</mdui:Logo>
> </mdui:UIInfo>
> </md:Extensions>
> <md:KeyDescriptor use="signing">
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
>
> MIIEJzCCAo+gAwIBAgIUFVflFeQ4NpCU3NYG0qQKrw226uAwDQYJKoZIhvcNAQELBQAwGjEYMBYG
>
> A1UEAwwPaWRwMDEuamxmb28uY29tMB4XDTI1MDQwNjA2MjUyNVoXDTQ1MDQwNjA2MjUyNVowGjEY
> .
> .
> .
>
> 9US/kcq8hfIPv+ySvGGmkXMfkNa2LW7ynS8l9l5xmDRDBTUJpfrmUwkZy6sakt6Hijo6I3NZwOdn
> aO7YiTXMSVcvg+WesGYjxD76XHmeB+yhLGcM0SmP7jzYUF1pTQFgH7Q=
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:KeyDescriptor use="signing">
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
>
> MIIEJzCCAo+gAwIBAgIUc33YkmOgONgZLiUdIcRsVPItWCUwDQYJKoZIhvcNAQELBQAwGjEYMBYG
> .
> .
> .
>
> FUE/+meDluNbZ1nImkA/lxDXS3/OLLkUveiJAcRhWxsNpHChdRtPVtaDqrqJYlsCpQ+WLw0H96tn
> W67RAmB9Kzs+onJfucXTYeLdTcv7sK8FPvxUWbsJj0bgXidpuhCXFUs=
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:KeyDescriptor use="encryption">
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
>
> MIIEKDCCApCgAwIBAgIVAND4cmlh4HBvqH5194gzyg5j7NuLMA0GCSqGSIb3DQEBCwUAMBoxGDAW
>
> BgNVBAMMD2lkcDAxLmpsZm9vLmNvbTAeFw0yNTA0MDYwNjI1MjFaFw00NTA0MDYwNjI1MjFaMBox
> .
> .
> .
>
> UYAGrJ7dhWR0sWXxp/MhThMoJVorZodOCwGl8Pi+fqkqJMsF72m12vuzfEoToCHizliNMfCol9e5
> Vw6XXsiDumInpvSGy6vQOelecNYdCTVa0lX+3DuOABSQk0iASPMdlo2+
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="
> https://idp01.xxxx.com:34487/idp/profile/SAML2/SOAP/ArtifactResolution" />
> <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
> Location="
> https://idp01.xxxx.com:34487/idp/profile/SAML2/POST-SimpleSign/SSO" />
> <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://idp01.xxxx.com:34487/idp/profile/SAML2/Redirect/SSO" />
> <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://idp01.xxxx.com:34487/idp/profile/SAML2/POST/SSO" />
> </md:IDPSSODescriptor>
> </md:EntityDescriptor>
Thanks,
Jim
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
On Wed, Apr 9, 2025 at 6:14 PM Peter Schober via users <users at shibboleth.net>
wrote:
> o haya via users <users at shibboleth.net> [2025-04-09 23:57 CEST]:
> > Were you thinking that I had already copied that Are you saying that
> > "conf/examples/attribute-resolver-ldap.xml" file over the original
> > "conf/attribute-resolver.xml" file?
>
> I'd start with LDAP by copying over the DataConnector from the
> provided example file, yes. That's what the example files are for.
> Then also copy over one of the AttributeDefinitions and adapt that to
> match what's in your LDAP DSA.
>
> > Also, I have a separate question: As mentioned, I am using an OpenDJ
> > LDAP.... the login for the LDAP is using "cn=Directory Manager"
>
> Which is irrelevant at this point as you've configured the
> anonSearchAuthenticator. (Or that's default, then you have not yet
> configured the bindSearchAuthenticator that would perform a bind
> first.)
>
> > which I
> > have set in one of the properties in the ldap.properties file, but I'd
> been
> > wondering where the password for the "cn=Directory Manager" is supposed
> to
> > be set, and I think I just found that is be in the
> > /opt/shibboleth-idp/credentials/secrets.properties.
>
> Yup.
>
> > That secrets.properties file has:
> >
> > # Default access to LDAP authn and attribute stores.
> > > idp.authn.LDAP.bindDNCredential =myServicePassword
> > > idp.attribute.resolver.LDAP.bindDNCredential
> =%{idp.authn.LDAP.bindDNCredential:undefined}
> >
> > I am *assuming* that I should put the password for the "cn=Directory
> > Manager" as the value for the 2nd line (i.e., replace the
> > "myServicePassword" with the password for the "cn=Directory Manager",
> but I
> > kind of unclear what to do to the 3rd line? Should I also replace the
> > "undefined" with that same password value?
>
> Java properties can reference other Java properties (which is why when
> you replace "myServicePassword" in the 1st line above it'll also be
> set for the 2nd line above).
> Furthermore, they can have default/fallback values so that they are
> not undefined when no value has been set (2nd line, after the colon).
> Ignore that part for now and just set the password for your bind user
> in the 1st line.
>
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250410/33e1eab5/attachment.htm>
More information about the users
mailing list