<div dir="ltr">Scott -- NameID and Attributes are different, but I can use either to associate a user from the ldap database with the user in salesforce. I can set a Federation ID for a salesforce user and make that the persistent NameID that Shibboleth is sending up. <div><br></div><div>in saml-nameid.xml I comment out the bean for TransientGenerator and uncomment the one for persistent generator:<br></div><div>
<p class=""><span class=""><</span><span class="">util</span><span class="">:</span><span class="">list </span><span class="">id</span><span class="">=</span>"shibboleth.SAML2NameIDGenerators"<span class="">></span></p></div><div>
<p class=""> <ref bean="shibboleth.SAML2PersistentGenerator" /></p><p class="">In saml-nameid.properties I uncomment the lines for:</p><p class="">
</p><p class="">idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator</p><p class="">
</p><p class=""><span class="">idp.persistentId.sourceAttribute</span><span class=""> = </span>"%{idp.authn.LDAP.baseDN}"</p>
<p class="">
</p><p class="">idp.persistentId.salt<span class=""> = </span><span class="">"randomstring123"</span></p><p class=""><br></p><p class="">but the NameID Field no longer exists when I do that.</p><p class=""><br></p><p class="">After I log in I only get one more line of the log</p><p class="">2015-10-27 17:26:46,336 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []</p><p class="">
</p><p class="">2015-10-27 17:27:13,984 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'user1' succeeded</p><p class=""><br></p><p class="">I'm looking at the assertion in the SAML tracer plugin on Firefox and see there is no Attribute Block so I guess it is the attribute-resolver.xml file that I'm doing something incorrectly in? </p><p class="">Is there any other info that I can get you where we might see the problem?</p><p class=""><br></p><p class="">Tom -- ok, thanks I didn't really know what I was looking at, just saw the empty array for attributes and made the assumption.</p><p class="">I see</p><p class="">{</p><p class="">"requester": "<a href="https://sp.testshib.org">https://sp.testshib.org</a>",</p><p class="">"principal": "user1",</p><p class="">"attributes": [</p><p class=""><br></p><p class=""><br></p><p class="">]</p><p class="">
</p><p class="">}</p><p class="">when I run aacli.sh. Does this give us any insight into my problem? Are there any other tests I can run or info I can get to help us find the problem?</p><p class=""><br></p><p class="">Thanks everyone!</p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 27, 2015 at 12:33 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 10/27/15, 10:38 AM, "users on behalf of Taylor Centers" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:taylor.centers@gmail.com">taylor.centers@gmail.com</a>> wrote:<br>
<br>
<br>
<br>
>I'm trying to get my ldap database associated with the users in the salesforce account, but no identifying information is being sent up with the assertion. The Subject, NameID is a random transient value, and I couldn't figure out how to make it a persistent<br>
> hash of user data. I tried changing saml-nameid.xml and saml-nameid.properties with no results, the entire NameID block would disappear from the assertion if I tried changing it.<br>
<br>
</span>Well, I can't do more than point you at the documentation. If you have a specific question about any of what the documentation tells you to change, just ask.<br>
<br>
But before I point at any docs, I have to know the use case. Are you absolutely certain you're needing to use a SAML persistent ID with Salesforce? I very much doubt that. I don't think you can in fact.<br>
<span class=""><br>
>Below is what I think the relevant files and fields for adding an attribute to the assertion, in my case the user's email.<br>
<br>
</span>A NameID and an Attribute are not the same. I don't know which Salesforce requires. My recollection is they allow for either, but I'm not sure.<br>
<span class=""><br>
>But I am seeing no effect. The logs look like it is getting the 'mail' attribute or at least parses the configuration properly, but I the array for included attributes is empty.<br>
<br>
</span>No, it's not (as Tom noted). If you have logs indicating the assertion doesn't contain any Attributes, then the resolver is the problem. But that log is showing nothing, it's the startup log with no sign of actual use of the IdP yet.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>