<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I want to allow user logons at our v3 IdP with either sAMAccountName or userPrincipalName. I made the following changes to
<b>ldap.properties</b>, and logons succeed with either username.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">idp.authn.LDAP.userFilter = (|(sAMAccountName={user})(userPrincipalName={user}))<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">idp.attribute.resolver.LDAP.searchFilter = (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, I want a consistent principal name used in the IdP, particularly for our interaction with Box. I’m trying to get Subject Canonicalization to work and running into problems.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Following <a href="https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-Post-LoginCanonicalization">
https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-Post-LoginCanonicalization</a>, I’ve enabled the bean in
<b>subject-c14n.xml</b>.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <ref bean="c14n/x500" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <ref bean="c14n/simple" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And I’ve added an attribute that’s present in attribute-resolver.xml to
<b>attribute-sourced-subject-c14n-config.xml</b>.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <util:list id="shibboleth.c14n.attribute.AttributesToResolve"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <value>userPrincipalName</value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <util:list id="shibboleth.c14n.attribute.AttributeSourceIds"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> <value>userPrincipalName</value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">With this configuration, the IdP starts up fine but logon attempts result in a type mismatch error. This may be a bug.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 10:09:09,297 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New"">org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ResolveAttributes' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\c14n\attribute-sourced-subject-c14n-beans.xml]:
Initialization of bean failed; nested exception is org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.lang.String' to required type 'boolean' for property 'maskFailures'; nested exception is java.lang.IllegalArgumentException:
Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New""> at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:547)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New"">Caused by: org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.lang.String' to required type 'boolean' for property 'maskFailures'; nested
exception is java.lang.IllegalArgumentException: Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New""> at org.springframework.beans.BeanWrapperImpl.convertIfNecessary(BeanWrapperImpl.java:481)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New"">Caused by: java.lang.IllegalArgumentException: Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:8.0pt;font-family:"Courier New""> at org.springframework.beans.propertyeditors.CustomBooleanEditor.setAsText(CustomBooleanEditor.java:122)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve found I can make either of the following changes to <b>
attribute-sourced-subject-c14n-beans.xml</b>, and logons become successful. <o:p>
</o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Change:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> p:maskFailures="%{idp.service.attribute.resolver.maskFailures:true}"<o:p></o:p></span></p>
<p class="MsoNormal">To either:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> p:maskFailures="true"<o:p></o:p></span></p>
<p class="MsoNormal">or:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New""> p:maskFailures="false"<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Moving on however, idp-process.log indicates c14n subject resolution is not occurring. Have I missed a step?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn: CN=****,OU=People,OU=****,DC=****,DC=****<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by ****@****.***'
succeeded<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:274] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on
underlying flow descriptor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 3 canonicalization
flows into SubjectCanonicalizationContext<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization
flow c14n/attribute for applicability...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization
flow c14n/attribute<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:183] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:191] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the
following attribute definitions [sAMAccountName, userPrincipalName]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:360] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for
'sAMAccountName'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:310] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector
myLDAP<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder:203] - Template text (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))
yields (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy:58] - Results did not contain any entries, nothing to map<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:89] - myLDAP no attributes were produced during resolution<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'myLDAP' produced no value.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:338] - Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'myLDAP' produced
no attributes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:376] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies
for sAMAccountName<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] - Attribute Definition 'sAMAccountName': produced an attribute with no values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'sAMAccountName'
produced an attribute with 0 values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:360] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for
'userPrincipalName'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:376] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies
for userPrincipalName<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] - Attribute Definition 'userPrincipalName': produced an attribute with no values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'userPrincipalName'
produced an attribute with 0 values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:201] - Attribute Resolver 'ShibbolethAttributeResolver': Finalizing resolved attributes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:414] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute
definition 'sAMAccountName', contains no values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:414] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute
definition 'userPrincipalName', contains no values<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:206] - Attribute Resolver 'ShibbolethAttributeResolver': Final resolved attribute
collection: []<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - WARN [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:146] - Profile Action AttributeSourcedSubjectCanonicalization: No attributes found,
canonicalization not possible<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - INFO [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:62] - Profile Action SelectSubjectCanonicalizationFlow: Moving incomplete flow c14n/attribute
to intermediate set, reselecting a different one<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization
flow c14n/x500 for applicability...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500
was not applicable to this request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization
flow c14n/simple for applicability...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization
flow c14n/simple<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>