<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><style type="text/css">body { background: rgba(250, 235, 255, 255); }</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Integrating vendor site and digesting their metadata. Login attempt at their site successfully re-directs to our IdP and generates required attributes, but fails to produce expected SAML assertion of authN and attributes.<div>I see the warning that no attribute can be encoded as NameIdentifier in “required” format; “good” responses to other SPs have messages that no attribute can be encoded as NameIdentifier in “supported” format (not labeled warning).</div><div>I suspect this should tell me something useful, but admit I don’t understand what it’s telling me. Your help appreciated,</div><div><br></div><div>David Bantz</div><div>U Alaska</div><div><br><div><br></div><div><b style="font-size: 13px;">Debug-level log fragment</b>:</div><div><br></div><div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.113 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114] - Filtered attributes for principal dabantz. The following attributes remain: [surname, email, eduPersonPrincipalName, givenName]</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.113 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:501] - Creating attribute statement in response to SAML request 'id-1fa5a56e5e1d2231ef97d750c8adce1a' from relying party '<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>'</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute surname with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute email with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute eduPersonPrincipalName with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2ScopedStringAttributeEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute givenName with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:509] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute surname, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute email, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute eduPersonPrincipalName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute givenName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:465] - Attempting to select name identifier attribute for relying party '<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>' that requires format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'</div><div style="margin: 0px;"><font face="Monaco" size="1" color="#ff2613"><u>10:03:53.115 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:473] - No attribute of principal 'dabantz' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party '<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>'</u></font></div><div style="margin: 0px;"><font face="Monaco" size="1">10:03:53.138 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:778] - Encoding response to SAML request id-1fa5a56e5e1d2231ef97d750c8adce1a from relying party <a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a></font></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.138 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:49] - Beginning encode message to outbound transport of type: org.opensaml.ws.transport.http.HttpServletResponseAdapter</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.138 - DEBUG [org.opensaml.common.SAMLObjectHelper:56] - Examing signed object for content references with exclusive canonicalization transform</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.138 - DEBUG [org.opensaml.common.SAMLObjectHelper:70] - Saw exclusive transform, declaring non-visible namespaces on signed object</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:100] - Starting to marshall {<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>}Signature</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:103] - Creating XMLSignature object</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:113] - Adding content to XMLSignature.</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.139 - DEBUG [org.opensaml.common.impl.SAMLObjectContentReference:174] - Adding list of inclusive namespaces for signature exclusive canonicalization transform</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.140 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:118] - Creating Signature DOM element</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.140 - DEBUG [org.opensaml.xml.signature.Signer:76] - Computing signature over XMLSignature object</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.150 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:124] - Invoking Velocity template to create POST body</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.151 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:158] - Encoding action url of '<a href="https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu'">https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu'</a> with encoded value 'https&#x3a;&#x2f;&#x2f;<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>&#x2f;fuze&#x2f;saml_verify&#x2f;alaskaedu'</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.151 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:161] - Marshalling and Base64 encoding SAML message</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.154 - DEBUG [PROTOCOL_MESSAGE:74] - </div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"><?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu">https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu</a>" ID="_d4e8bfd0abb3f317c3118c6c6ae5b687" InResponseTo="id-1fa5a56e5e1d2231ef97d750c8adce1a" IssueInstant="2013-11-12T19:03:53.137Z" Version="2.0"></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:alaska.edu</saml2:Issuer></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:SignedInfo></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:Reference URI="#_d4e8bfd0abb3f317c3118c6c6ae5b687"></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:Transforms></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:Transforms></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"/></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:DigestValue>JfS1I36EYVMD150rFhQCabfhWiw=</ds:DigestValue></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:Reference></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:SignedInfo></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:SignatureValue>tich/3vqKBzxBAeft7vmFfm2DnBE3x6v38gS4duzG8kL/LyBElBfrq/qOu7Q4l18DS4XUIV/7L7bVNcczIBNaJHrz6hRLnonBsilnGJmLB+4ttUN8dnqtTLikysNa34A9RbeCHM+If5G11NKJeqT+Bubb74h1g/hM5N4Tp8AjtCjtYyYfKuFzan9U/ytsFf82iC2++QWzR7GbvpGyz7CwEUDo1gXDsN8mLAC3krkagF4OKBsMdliMDhwBhy8D4Pq7GvXi7gjFBSalxti45Wv3f8pvmcIgd/+76+74GHBxxqdJ1r2DrA4u8O6cFhUKRg2VLg4jZ6hQMSXAo6ZRgyG0g==</ds:SignatureValue></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:KeyInfo></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:X509Data></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <ds:...</ds:X509Certificate></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:X509Data></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:KeyInfo></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </ds:Signature></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <saml2p:Status></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"><font color="#e72110"><u> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"</u>/></font></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </saml2p:StatusCode></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> <saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"> </saml2p:Status></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;"></saml2p:Response></div><div style="margin: 0px; font-size: 10px; font-family: Monaco; min-height: 14px;"><br></div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.155 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.</div><div style="margin: 0px; font-size: 10px; font-family: Monaco;">10:03:53.155 - INFO [Shibboleth-Audit:989] - 20131112T190353Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|id-1fa5a56e5e1d2231ef97d750c8adce1a|<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:alaska.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_d4e8bfd0abb3f317c3118c6c6ae5b687|dabantz|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|surname,email,eduPersonPrincipalName,givenName,|||</div><div style="margin: 0px; font-size: 10px; font-family: Monaco; min-height: 14px;"><br></div></div></div><div style="margin: 0px; font-size: 10px; min-height: 14px;"><b style="font-size: 14px;">Vendor’s metadata</b><span style="font-family: Monaco;">:</span></div><div style="margin: 0px; font-size: 10px; font-family: Monaco; min-height: 14px;"><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(90, 125, 76);"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><div style="margin: 0px;"><span style="color: #091480"><ns0:EntityDescriptor </span><span style="color: #4b5a7d">xmlns:ns0=</span>"urn:oasis:names:tc:SAML:2.0:metadata"<span style="color: #091480"> </span><span style="color: #098021">entityID=</span>"<a href="http://www.fuzemeeting.com">www.fuzemeeting.com</a>"<span style="color: #091480">></span></div><div style="margin: 0px; color: rgb(9, 128, 33);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #091480"><ns0:SPSSODescriptor </span>AuthnRequestsSigned=<span style="color: #ff9300">"false"</span><span style="color: #091480"> </span>WantAssertionsSigned=<span style="color: #ff9300">"true"</span><span style="color: #091480"> </span>protocolSupportEnumeration=<span style="color: #ff9300">"urn:oasis:names:tc:SAML:2.0:protocol"</span><span style="color: #091480">></span></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:KeyDescriptor></div><div style="margin: 0px;"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #091480"><ns1:KeyInfo </span><span style="color: #4b5a7d">xmlns:ns1=</span>"<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"<span style="color: #091480">></span></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns1:X509Data></div><div style="margin: 0px; color: rgb(50, 51, 51);"><span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #091480"><ns1:X509Certificate>...</span></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns1:X509Certificate></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns1:X509Data></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns1:KeyInfo></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns0:KeyDescriptor></div><div style="margin: 0px;"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #091480"><ns0:AssertionConsumerService </span><span style="color: #098021">Binding=</span>"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<span style="color: #091480"> </span><span style="color: #098021">Location=</span>"<a href="https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu">https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu</a>"<span style="color: #091480"> </span><span style="color: #098021">index=</span>"1"<span style="color: #091480">/></span></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns0:SPSSODescriptor></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:Organization></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:OrganizationName <span style="color: #098021">xml:lang=</span><span style="color: #ff9300">"en"</span>><span style="color: #323333">FuzeBox</span></ns0:OrganizationName></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:OrganizationDisplayName <span style="color: #098021">xml:lang=</span><span style="color: #ff9300">"en"</span>><span style="color: #323333">FB SAML</span></ns0:OrganizationDisplayName></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:OrganizationURL <span style="color: #098021">xml:lang=</span><span style="color: #ff9300">"en"</span>><span style="color: #323333"><a href="https://www.fuzebox.com">https://www.fuzebox.com</a></span></ns0:OrganizationURL></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span></ns0:Organization></div><div style="margin: 0px; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><ns0:ContactPerson <span style="color: #098021">contactType=</span><span style="color: #ff9300">"technical"</span>/></div><div style="margin: 0px; color: rgb(9, 20, 128);"></ns0:EntityDescriptor></div><div><br></div></div></div></body></html>