<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class="">I’ve read through the wiki, and posts on this list, and tried a bunch of things but have not made a breakthrough. If someone could please describe what I need to do, to re-create what we had for V2 NameID/Subject that would be Super helpful .
This is specific to a vendor SP, that is breaking with a “Key Validation error” their side, with no other details. We are in the process of getting more info from them. However, till then, I need to figure out how to re-create the NameID as in V2.</div>
<div class=""><br class="">
</div>
<div class="">Many Many Thanks! </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Referenced -<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22" class="">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith”Unspecified"</a></div>
<div class=""><br class="">
</div>
<div class="">Specific file changes that need to be made: </div>
<div class="">
<ul class="MailOutline">
<li class="">saml-nameid.xml — Any other bean needs to be added here?
<ul class="">
<li class=""></li><li class=""><!-- SAML 2 NameID Generation --></li><li class=""> <util:list id="shibboleth.SAML2NameIDGenerators"></li><li class=""><br class="">
</li><li class=""> <ref bean="shibboleth.SAML2TransientGenerator" /></li><li class=""> </li><li class=""> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --></li><li class=""> <!--</li><li class=""> <ref bean="shibboleth.SAML2PersistentGenerator" /></li><li class=""> --></li><li class=""><br class="">
</li><li class=""> <!--</li><li class=""> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</li><li class=""> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</li><li class=""> p:attributeSourceIds="#{ {'mail'} }" /></li><li class=""> --></li><li class=""><br class="">
</li><li class=""> </util:list></li><li class=""><br class="">
</li><li class=""><br class="">
</li><li class=""> <!-- SAML 1 NameIdentifier Generation --></li><li class=""> <util:list id="shibboleth.SAML1NameIdentifierGenerators"></li><li class=""><br class="">
</li><li class=""> <ref bean="shibboleth.SAML1TransientGenerator" /></li><li class=""><br class="">
</li><li class=""> <!--</li><li class=""> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"</li><li class=""> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</li><li class=""> p:attributeSourceIds="#{ {'mail'} }" /></li><li class=""> --></li><li class=""><br class="">
</li><li class=""><br class="">
</li><li class=""> </util:list></li><li class=""></li><li class=""><br class="">
</li></ul>
</li><li class="">saml-nameid.properties — Do I uncomment these lines?
<ul class="">
<li class=""># Comment out to disable legacy NameID generation via Attribute Resolver</li><li class="">#idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator</li><li class="">#idp.nameid.saml1.legacyGenerator = shibboleth.LegacySAML1NameIdentifierGenerator
<div class=""><br class="">
</div>
</li></ul>
</li><li class="">relying-party.xml — Added the following bean in the “Overrides” section.
<ul class="">
<li class=""><br class="">
</li><li class=""><!-- Container for any overrides you want to add. --></li><li class=""><util:list id="shibboleth.RelyingPartyOverrides"></li><li class=""><br class="">
</li><li class=""><span class="Apple-tab-span" style="white-space: pre;"></span><!-- V3 Vendor NameID format needs to be unspecified --></li><li class=""> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://vendoraddress.com" class="">https://vendoraddress.com</a>"></li><li class=""> <property name="profileConfigurations"></li><li class=""> <list></li><li class=""> <!-- Your refs or beans here. --></li><li class=""> <bean parent="Shibboleth.SSO" /></li><li class=""> <ref bean="SAML1.AttributeQuery" /></li><li class=""> <ref bean="SAML1.ArtifactResolution" /></li><li class=""> <bean parent="SAML2.SSO" p:encryptNameIDs="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/></li><li class=""> <bean parent="SAML2.AttributeQuery" p:encryptAssertions="false" p:encryptNameIDs="false" /></li><li class=""> <ref bean="SAML2.ArtifactResolution" /></li><li class=""> </list></li><li class=""> </property></li><li class=""> </bean></li><li class=""></util:list></li><li class="">
<div class=""><br class="">
</div>
</li></ul>
</li><li class="">attribute-resolver.xml — These V2 name encoders are NOT defined in V3 file.. Does something still need to go for V3?
<ul class="">
<li class=""></li><li class=""></li><li class=""><!— V2 entry NOT included in V3 —></li><li class=""><RelyingParty id="<a href="https://vendoraddress.com" class="">https://vendoraddress.com</a>"</li><li class=""> provider="<a href="https://campus.edu/idp/shibboleth" class="">https://campus.edu/idp/shibboleth</a>"</li><li class=""> defaultSigningCredentialRef="IdPCredential"></li><li class=""> <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" /></li><li class=""></RelyingParty></li><li class=""><br class="">
</li><li class=""><br class="">
</li><li class=""><br class="">
</li><li class=""><br class="">
</li><li class=""> <!— V2 Name Identifier related attributes NOT included in V3 --></li><li class=""> <resolver:AttributeDefinition id="transientId" xsi:type="TransientId" xmlns="urn:mace:shibboleth:2.0:resolver:ad"></li><li class=""> <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"</li><li class=""> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" /></li><li class=""> </li><li class=""> <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"</li><li class=""> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /></li><li class=""><br class="">
</li><li class=""> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</li><li class=""> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /></li><li class=""><br class="">
</li><li class=""> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</li><li class=""> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></li><li class=""> </resolver:AttributeDefinition>
<div class=""><br class="">
</div>
</li></ul>
</li><li class="">idp.properties
<ul class="">
<li class="">set with idp.encryption.optional = true</li></ul>
</li></ul>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<pre id="txt" class=""><div class=""><font face="Helvetica" class=""><—————— V2 output ——————></font></div><div class=""></div></pre>
<div class=""><saml2:Subject></div>
<div class="">
<pre id="txt" class=""><div class=""><pre id="txt" class=""><font face="Helvetica" class=""><b class=""> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
</b> NameQualifier="<a href="https://campus.edu/idp/shibboleth" class="">https://campus.edu/idp/shibboleth</a>"
>_2d09e366ab65d5708809090e123d</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address=“IP Address"
InResponseTo="_729ebc6d-8c67-491d-803b-741e63bfd686"
NotOnOrAfter="2016-10-18T14:59:46.721Z"
Recipient="<a href="https://vendoraddress.com/saml/authenticate" class="">https://vendoraddress.com/saml/authenticate</a>"
/>
</saml2:SubjectConfirmation>
</saml2:Subject></font></pre><div class=""><font face="Helvetica" class=""><br class=""></font></div></div><div class=""><font face="Helvetica" class=""><br class=""></font></div><div class=""><font face="Helvetica" class=""><—————— V3 output ——————></font></div><div class=""><pre id="txt" class=""><font face="Helvetica" class=""><saml2:Subject>
<b class=""> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
</b> NameQualifier="<a href="https://campus.edu/idp/shibboleth" class="">https://campus.edu/idp/shibboleth</a>”</font></pre><pre id="txt" class=""><b class=""><span style="font-family: Helvetica;" class=""> SPNameQualifier="</span><a href="https://vendoraddress.com" style="font-family: Helvetica;" class="">https://vendoraddress.com</a><span style="font-family: Helvetica;" class="">"</span></b></pre><pre id="txt" class=""><font face="Helvetica" class=""> >AAdzZWNyZXQxvYMRAfUbww3NTdQF0A9ZuZA9L9PJltQU/izc7XRfNCozmkQEbfjs8aAH4+WpTGdkiNjlYTmi3Y38BLf9t0Dbqph2CLP0NEASYcKoUON+FV/RcIT/I4VAfQwqm0p7fvmksELns1g=</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="107.15.102.145"
InResponseTo="_8e867562-db15-4c53-8e1c-7354b32bdf6f"
NotOnOrAfter="2016-10-18T15:02:43.799Z"
Recipient="<a href="https://vendoraddress.com/saml/authenticate" class="">https://vendoraddress.com/saml/authenticate"</a>
</saml2:SubjectConfirmation>
</saml2:Subject></font></pre></div><div class=""><font face="Helvetica" class=""><br class=""></font></div><div class=""><font face="Helvetica" class=""><br class=""></font></div><div class=""><font face="Helvetica" class="">Thanks, </font></div><div class=""><font face="Helvetica" class="">Shweta</font></div><div class=""><br class=""></div></pre>
</div>
</body>
</html>