<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>David,</p>
<p><br>
</p>
<p>I typically get that message when the IdP is trying to generate a NameID, but it's unable to do so because I'm not releasing an attribute that meets the requirements of the request.</p>
<p><br>
</p>
<p>Whether you're using actual persistentId's with other SP's, I don't know, but you'll probably need to define something in saml-nameid.xml for this if it's going to use the actual NameID signaling.</p>
<p><br>
</p>
<p>If so, then you'll want to make a NameID generation definition that is conditional on the identity of the relying party. If not, you can do something icky in there. Secret option #3 is not using NameID signaling at all, but instead forcibly releasing the
attribute in a deprecated way, which won't be an option in v4.</p>
<p><br>
</p>
<p>It's worth noting for the peanut gallery that this isn't really what persistent NameID's should be populated with.</p>
<p><br>
</p>
<p>Hope this helps,</p>
<p>Nate.</p>
<p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of IAM David Bantz <dabantz@alaska.edu><br>
<b>Sent:</b> Monday, September 11, 2017 4:25:41 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> nameID format error</font>
<div> </div>
</div>
<div>
<div dir="ltr">I'm obviously missing something triggering "unsupportable identifier format", but haven't been able to spot it; pointers appreciated.
<div>
<p class="gmail-p1"><span class="gmail-s1">incoming request:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class="gmail-s1"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br>
</span><span class="gmail-s1"><span class="gmail-Apple-converted-space">
</span>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"...</span><span class="gmail-s1"><br>
</span><span class="gmail-s1"><span class="gmail-Apple-converted-space">
</span>ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"...</span> </blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class="gmail-s1"><br>
</span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>
<saml:Issuer><a href="https://integration.oohlalamobile.com/saml/uasitka/metadata">https://integration.oohlalamobile.com/saml/uasitka/metadata</a></saml:Issuer><br>
</span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>
<samlp:<b>NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</b></span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>AllowCreate="true"</span><span class="gmail-s1"><span class="gmail-Apple-converted-space"> </span>/>...</span><span class="gmail-s1"><br>
</span><span class="gmail-s1"></samlp:AuthnRequest></span></blockquote>
<p class="gmail-p4">in attribute-resolver:</p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class="gmail-s2"><AttributeDefinition </span><span class="gmail-s3">id</span><span class="gmail-s4">=</span><span class="gmail-s5">"</span><span class="gmail-s6">eduPersonUniqueID</span><span class="gmail-s5">"</span><span class="gmail-s2">
</span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s5">"Simple"</span><span class="gmail-s2">
<span class="gmail-Apple-converted-space"> <br>
</span></span><span class="gmail-s2"> </span><span class="gmail-s3">sourceAttributeID</span><span class="gmail-s4">=</span><span class="gmail-s5">"uakPersonID"</span><span class="gmail-s2">><br>
</span><span class="gmail-s4"> </span><span class="gmail-s2"><Dependency </span>
<span class="gmail-s3">ref</span><span class="gmail-s4">=</span><span class="gmail-s5">"uakPersonID"</span><span class="gmail-s2"> /><br>
</span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeEncoder
</span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"SAML2ScopedString"</span><span class="gmail-s8"> <br>
</span><span class="gmail-s8"> </span><span class="gmail-s3">name</span><span class="gmail-s4">=</span><span class="gmail-s2">"urn:oid:1.3.6.1.4.1.5923.1.1.1.13"</span><span class="gmail-s8">
</span><span class="gmail-s3">friendlyName</span><span class="gmail-s4">=</span><span class="gmail-s2">"</span><span class="gmail-s6">eduPersonUniqueID</span><span class="gmail-s2">"</span><span class="gmail-s8">></AttributeEncoder><br>
</span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeEncoder
</span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"SAML2StringNameID"<br>
</span><span class="gmail-s8"> </span><span class="gmail-s3">nameFormat</span><span class="gmail-s4">=</span><span class="gmail-s2">"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</span><span class="gmail-s8"> /><br>
</span><span class="gmail-s2"></AttributeDefinition></span></blockquote>
<p class="gmail-p7"><span class="gmail-s2"></span></p>
<p class="gmail-p8"><span class="gmail-s2">in attribute-filter:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class="gmail-s2"><AttributeFilterPolicy </span><span class="gmail-s3">id</span><span class="gmail-s4">=</span><span class="gmail-s5">"releaseToOohLaLa"</span><span class="gmail-s2">><br>
</span><span class="gmail-s4"> </span><span class="gmail-s8"><PolicyRequirementRule
</span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s2">"Requester"</span><span class="gmail-s8">
</span><span class="gmail-s3">value</span><span class="gmail-s4">=</span><span class="gmail-s2">"<a href="https://integration.oohlalamobile.com/saml/uasitka/metadata">https://integration.oohlalamobile.com/saml/uasitka/metadata</a>"</span><span class="gmail-s8">
/><br>
</span><span class="gmail-s4"> </span><span class="gmail-s8"><AttributeRule
</span><span class="gmail-s3">attributeID</span><span class="gmail-s4">=</span><span class="gmail-s5">"</span><span class="gmail-s9">eduPersonUniqueID</span><span class="gmail-s5">"</span><span class="gmail-s8">><br>
</span><span class="gmail-s4"> </span><span class="gmail-s2"><PermitValueRule
</span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s4">=</span><span class="gmail-s5">"ANY"</span><span class="gmail-s2">/><br>
</span><span class="gmail-s4"> </span><span class="gmail-s2"></AttributeRule></span>...</blockquote>
<p class="gmail-p8"><span class="gmail-s2">in relying-party:</span></p>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span><bean parent="RelyingPartyByName"<br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span>c:relyingPartyIds="#{{'<a href="https://integration.oohlalamobile.com/saml/uasitka/metadata'}">https://integration.oohlalamobile.com/saml/uasitka/metadata'}</a>}"><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span><property name="profileConfigurations"><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span><list><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span><bean parent="SAML2.SSO"<br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span>p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span></list><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space">
</span></property><br>
</span><span class="gmail-s2"><span class="gmail-Apple-converted-space"> </span>
</bean></span></blockquote>
<p class="gmail-p8"><span class="gmail-s2">in the process log:</span></p>
<p class="gmail-p4">11:39:43:908<span class="gmail-Apple-converted-space"> </span>
WARN [192.252.140.146] org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337 ><span class="gmail-Apple-converted-space">
</span>Profile Action AddNameIDToSubjects: <b>Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</b></p>
<p class="gmail-p4">11:39:43:909<span class="gmail-Apple-converted-space"> </span>
WARN [192.252.140.146] org.opensaml.profile.action.impl.LogEvent:105 ><span class="gmail-Apple-converted-space">
</span>A non-proceed event occurred while processing the request: InvalidNameIDPolicy</p>
</div>
</div>
</div>
</body>
</html>