<BR>
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.im
{mso-style-name:im;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">No. I took relying party from V2.4 and pasted in V3.2. So, headers of relying-party.xml are different. Release of nameid-emailaddress was exactly the release
of nameid-unspecified. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As Scott mentioned, unspecified nameID should not in the metadata?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I read the document
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22">
https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22</a> but not sure where would I put those codes in. I just placed the code in relying-party.xml<o:p></o:p></span></p>
<p class="MsoNormal"><bean parent="RelyingPartyByName"<br>
c:relyingPartyIds="#{{XYZ'}}"><br>
<br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO.custom" p:signAssertions="true" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br>
</list><br>
</property><br>
</bean><br>
<br>
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Tomcat restart is throwing error on incorrect relying-party.xml load.<o:p></o:p></span></p>
<p class="MsoNormal">2017-02-22 17:11:39,181 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed<br>
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 298 in XML document from file [/opt/shibboleth-idp/conf/relying-party.xml] is invalid; nested exception is org.xml.sax.SAXParseException;
lineNumber: 298; columnNumber: 85; The prefix "c" for attribute "c:relyingPartyIds" associated with an element type "bean" is not bound.<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>IAM David Bantz<br>
<b>Sent:</b> Wednesday, February 22, 2017 6:00 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: v3.2 - unsupportable identifier -Name ID<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p align="center" style="text-align:center;background:white"><b><u><span style="font-size:13.0pt;color:#EE7600"><o:p></o:p></span></u></b></p>
<div>
<div>
<p class="MsoNormal">If I interpret correctly you took a relying party config and pasted it into the resolver.
<o:p></o:p></p>
<div>
<p class="MsoNormal">Don't do that.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Treat the release of nameid with nameid-format:unspecified exactly as you did the one with nameid-format:<span style="font-size:9.5pt">emailAddress</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">In fact it appears these have exactly the same values, so you only need one SAML attribute from the resolver, used as the source for nameids in either 'unspecified' or emalAddress format for different SPs.
No need to resolve the same value into two different SAML attributes.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">David Bantz</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">UA OIT IAM</span><o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Feb 22, 2017 at 1:19 PM, Ramaiah, Vanna G. <<a href="mailto:ramaiah@musc.edu" target="_blank">ramaiah@musc.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt">This is the error I get. I commented out the relying party config of SP xyz from v2 and added this below code. Should this be placed in other bean?<br>
<bean parent="RelyingPartyByName"<br>
c:relyingPartyIds="#{{XYZ'}}"><br>
<br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO.custom" p:signAssertions="true" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br>
</list><br>
</property><br>
</bean><br>
2017-02-22 17:11:39,181 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed<br>
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 298 in XML document from file [/opt/shibboleth-idp/conf/relying-party.xml] is invalid; nested exception is org.xml.sax.SAXParseException;
lineNumber: 298; columnNumber: 85; The prefix "c" for attribute "c:relyingPartyIds" associated with an element type "bean" is not bound.<br>
<br>
<br>
<span class="im">-----Original Message-----</span><br>
<span class="im">From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Cantor, Scott</span><br>
<span class="im">Sent: Wednesday, February 22, 2017 4:48 PM</span><br>
<span class="im">To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>></span><br>
<span class="im">Subject: Re: v3.2 - unsupportable identifier -Name ID</span><br>
<br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">On 2/22/17, 4:31 PM, "users on behalf of Ramaiah, Vanna G." <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:ramaiah@musc.edu">ramaiah@musc.edu</a>> wrote:<br>
<br>
> 3.In metadata of xyz,<br>
> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><br>
<br>
The documentation tells you explicitly that that doesn't work.<br>
<br>
> 4. I copy pasted the relying-party.xml from V2.4 to V3.2. where should the below segment go?<br>
<br>
I can't tell you how to structure your relying party rules, but the settings are fine.<br>
<br>
> 5. Should I add anything to saml-nameid.xml?<br>
<br>
The same thing you would add for any custom format. There is no difference here except for the fact that you can't trigger it with metadata.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>
<BR>