<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 15/12/2017 à 21:58, Cantor, Scott a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:D73F36D8-9AFA-4120-9881-2039418469B3@osu.edu">
<pre wrap="">Actually I will give you a concrete suggestion. Change the fail fast property on the NameID generation service in services.properties to true and restart.
-- Scott
</pre>
</blockquote>
<p>Good advice ! setting <i>idp.service.failFast = true</i> in <i>services.properties</i>
showed me a fail on IDP startup with :<br>
</p>
<p>Caused by:
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Service 'shibboleth.NameIdentifierGenerationService': could not
perform initial load<br>
ry.BeanCreationException: Error creating bean with name
'shibboleth.ComputedPersistentIdGenerator' defined in file
[/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]:
Invocation of init method failed; nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
<b>Salt must be at least 16 bytes in size</b></p>
<p>Indeed my initial salt of "1234" was not 16 byte in size ! so I
made it longer , and now my IDP does start without that error ,
good step forward .</p>
<p>I also uncomment in <i>saml-nameid.properties </i><br>
</p>
<p># To use a database, use shibboleth.StoredPersistentIdGenerator<br>
<b>idp.persistentId.generator =
shibboleth.ComputedPersistentIdGenerator</b><b><br>
</b></p>
<p>but you sais that is was a default, so no need to uncomment it
apparently , I didn't uncommented in the 1rst place beacause of
the comment just above regarding use a a DB that I miss understood
...<br>
</p>
<p>Now back to my initial need to acces that SP<br>
</p>
<pre wrap=""><a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp</a>
with those metadata requesting an eduPersonTargetedID and a persistent nameID-format
</pre>
<pre wrap=""><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:<b>nameid-format:persistent<</b>/md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:RequestedAttribute Name="urn:oid:<b>1.3.6.1.4.1.5923.1.1.1.10</b>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/></pre>
<p>and clearly asking for ePTID (eduPersonTargetedID)</p>
<p>From <a class="moz-txt-link-freetext" href="https://met.idem.garr.it/met/entity">https://met.idem.garr.it/met/entity</a><i>/https%253A%252F%252Fmonitor.eduroam.org%252Fsp%252Fmodule.php%252Fsaml%252Fsp%252Fmetadata.php%252Fdefault-sp/?federation=edugate-federation</i><i><br>
</i>
</p>
<i>
</i>
<p><i>Required attributes: </i><i><br>
</i><i>
urn:oid:1.3.6.1.4.1.5923.1.1.1.10 (eduPersonTargetedID)</i></p>
<p><br>
</p>
<p>from my IDP logs I now do generate a <b>nameid-format:persistent</b></p>
<p><i>2017-12-16 16:55:54,249 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- </i><i><b>Metadata specifies the following formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</b></i><i>,
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]</i><i><br>
</i></p>
<p><i>2017-12-16 16:55:54,250 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.PersistentSAML2NameIDGenerator:215]
- </i><i><b>Generating persistent NameID from Scoped
String-valued attribute eduPersonPrincipalName</b></i><i><br>
</i></p>
<p><i>2017-12-16 16:55:54,251 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118]
- </i><i><b>Successfully generated identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</b></i><i><br>
</i></p>
<p><i><?xml version="1.0" encoding="UTF-8"?></i><i><br>
</i><i><saml2:Assertion ID="_857fd67215521bceb9255b8cdc330565"</i><i><br>
</i><i> IssueInstant="2017-12-16T15:55:54.201Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></i><i><br>
</i><i>
<saml2:Issuer><a class="moz-txt-link-freetext" href="https://idp3.tem-tsp.eu/idp/shibboleth">https://idp3.tem-tsp.eu/idp/shibboleth</a></saml2:Issuer></i><i><br>
</i><i> <saml2:Subject></i><i><br>
</i><i> </i><i><b><saml2:NameID</b></i><i><br>
</i><i> </i><i><b>Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</b></i><i><br>
</i><i>
NameQualifier=<a class="moz-txt-link-rfc2396E" href="https://idpr3.tem-tsp.eu/idp/shibboleth">"https://idpr3.tem-tsp.eu/idp/shibboleth"</a>
SPNameQualifier=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp"</a>>cypRgyH6qc0Iifq1UFZGlgCKDLA=</saml2:NameID></i><i><br>
</i><i> <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></i><i><br>
</i><i> <saml2:SubjectConfirmationData
Address="91.160.29.24"</i><i><br>
</i><i>
InResponseTo="_355cfc3984ad6ddfd324ad97166832e3ab4315eb67"</i><i><br>
</i><i> NotOnOrAfter="2017-12-16T16:00:54.257Z"
Recipient=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp"</a>/></i><i><br>
</i><i> </saml2:SubjectConfirmation></i></p>
<p>but , now regardless of whether it should be enought what that
nameID format and addind a attribute definition for that
persistendID as an attribute definition with eduPersonTargetID
[ePTID] to do it might be deprecated, <br>
</p>
<p>as that SP requires it, I don't know how to generate ePTID from
the above computed persistenID nameID format I just finally end up
generating .</p>
<p>it clearly relates to previous same discussion:</p>
<p><a class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2016-March/028126.html">http://shibboleth.net/pipermail/users/2016-March/028126.html</a><br>
</p>
<p><a class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/users/2016-March/028138.html">http://shibboleth.net/pipermail/users/2016-March/028138.html</a></p>
<p>I defined in attribute-resolver an ePTID this way (maybe wrong ?)
:</p>
<p><i><resolver:AttributeDefinition id="eduPersonTargetedID"</i><i><br>
</i><i> xsi:type="ad:Simple"
sourceAttributeID="eduPersonPrincipalName"></i><i><br>
</i><i> <resolver:Dependency ref="myLDAP" /></i><i><br>
</i><i> <resolver:AttributeEncoder
xsi:type="enc:SAML1String"</i><i><br>
</i><i>
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /></i><i><br>
</i><i> <resolver:AttributeEncoder
xsi:type="enc:SAML2String"</i><i><br>
</i><i>
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" /></i><i><br>
</i><i> </resolver:AttributeDefinition></i><br>
<br>
</p>
<p>and it is well created and sent by my IDP :</p>
<p>2017-12-16 17:05:49,817 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167]
- Attribute filtering engine 'ShibbolethAttributeFilter': <b>1
values for attribute 'eduPersonTargetedID' remained after
filtering</b></p>
<p>2017-12-16 17:05:53,949 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73]
- Encoding value <a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a> of attribute
eduPersonTargetedID<br>
2017-12-16 17:05:53,949 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
- <b>Completed encoding 1 values for attribute
eduPersonTargetedID</b><br>
</p>
<p><b><saml2:Attribute FriendlyName="eduPersonTargetedID"</b><b><br>
</b><b> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></b><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute></p>
<p>but should'nt <b>NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
</b>be persistent instead of uri ?<b><br>
</b></p>
still acces to the SP loops on the login form without success, so I
guess I'am seding it a wrong ePTID, either as a nameID format (i
don't thing so) , but mostly a an bad attribute definition, probably
not correclty formated and not linked to the persistenID ?<br>
<br>
Sorry for that long discussion, but I suspect that I am not far from
succeed, and learn a lot on the subject that might also help others
.<br>
<br>
thanks .<br>
</body>
</html>