<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 18/12/2017 à 19:51, Andrew Morgan a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1712181045070.9075@shell.onid.oregonstate.edu">On
Mon, 18 Dec 2017, jehan procaccia wrote:
<br>
<br>
<blockquote type="cite">perhaps the warning mention on
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector">https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector</a>
regarding different xml schema whether we use 3.3 or lower ,
mine 3.2 !?
<br>
<br>
<br>
is there something wrong in my syntax ?
<br>
</blockquote>
<br>
Here is the same configuration before the XML namespace change:
<br>
<br>
<resolver:DataConnector xsi:type="dc:ComputedId"
<br>
id="computedID"
<br>
generatedAttributeID="computedID"
<br>
sourceAttributeID="%{idp.persistentId.sourceAttribute}"
<br>
salt="%{idp.persistentId.salt}">
<br>
<resolver:Dependency ref="myLDAP" />
<br>
</resolver:DataConnector>
<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
id="eduPersonTargetedID"
<br>
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
sourceAttributeID="computedID">
<br>
<resolver:Dependency ref="computedID" />
<br>
<resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<br>
<resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" />
<br>
</resolver:AttributeDefinition>
<br>
<br>
<br>
Thanks,
<br>
Andy<br>
<br>
</blockquote>
<p>thanks, that works fine now with your example using the 3.2 XML
namespace .</p>
<p>So I though that now I could access that SP as I send it correct
PersistendID and EPTID , but it still loops on the login process
with no specific error message . <br>
</p>
<p>I wrote to SPs technical contact with that long thread we had
here as a reference , I'am waiting for a reponse, but if someone
on the list can confirme that he/she can acces that SP I would be
assured that the pb still reside on my IDP and not
monitor.eduroam.org SP !.</p>
here is the SAML assertion my IDP finally sends to that SP :<br>
<p>2017-12-19 13:38:33,906 - DEBUG
[org.opensaml.saml.saml2.profile.impl.EncryptAssertions:132] -
Profile Action EncryptAssertions: Assertion before encryption:<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<saml2:Assertion ID="_f4d649d8cada1f44d2efa5ff53ff3324"<br>
IssueInstant="2017-12-19T12:38:33.763Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>
<saml2:Issuer><a class="moz-txt-link-freetext" href="https://idp3.tem-tsp.eu/idp/shibboleth">https://idp3.tem-tsp.eu/idp/shibboleth</a></saml2:Issuer><br>
<saml2:Subject><br>
<b><saml2:NameID</b><b><br>
</b><b>
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</b><br>
NameQualifier=<a class="moz-txt-link-rfc2396E" href="https://idp3.tem-tsp.eu/idp/shibboleth">"https://idp3.tem-tsp.eu/idp/shibboleth"</a>
SPNameQualifier=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp"</a>>cypRgyH6cq0Iifq1UFZGlgCKLDB=</saml2:NameID><br>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br>
<saml2:SubjectConfirmationData
Address="91.160.129.124"<br>
InResponseTo="_652d7ff66093e86dc79aa45711b99f7dfdcf7a2501"<br>
NotOnOrAfter="2017-12-19T12:43:33.835Z"
Recipient=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp"</a>/><br>
</saml2:SubjectConfirmation><br>
</saml2:Subject><br>
<saml2:Conditions NotBefore="2017-12-19T12:38:33.763Z"
NotOnOrAfter="2017-12-19T12:43:33.763Z"><br>
<saml2:AudienceRestriction><br>
<saml2:Audience><a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp</a></saml2:Audience><br>
</saml2:AudienceRestriction><br>
</saml2:Conditions><br>
<saml2:AuthnStatement
AuthnInstant="2017-12-19T12:38:27.135Z"
SessionIndex="_26a4eacab6d659a933907f74b73cf807"><br>
<saml2:SubjectLocality Address="91.160.129.124"/><br>
<saml2:AuthnContext><br>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><br>
</saml2:AuthnContext><br>
</saml2:AuthnStatement><br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="uid"<br>
Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">procaccia</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="mail"<br>
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:jehan.procaccia@tem-tsp.eu">jehan.procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute><br>
<b><saml2:Attribute FriendlyName="eduPersonTargetedID"</b><b><br>
</b><b> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></b><b><br>
</b><b> <saml2:AttributeValue></b><b><br>
</b><b> <saml2:NameID</b><b><br>
</b><b>
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</b><b><br>
</b><b>
NameQualifier=<a class="moz-txt-link-rfc2396E" href="https://idpr3.tem-tsp.eu/idp/shibboleth">"https://idpr3.tem-tsp.eu/idp/shibboleth"</a>
SPNameQualifier=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp"</a>>cypRgyH6cq0Iifq1UFZGlgCKLDB=</saml2:NameID></b><br>
</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonPrincipalName"<br>
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute><br>
</saml2:AttributeStatement><br>
</saml2:Assertion><br>
<br>
</p>
<p>2017-12-19 13:38:34,036 - INFO [Shibboleth-Audit.SSO:241] -
20171219T123834Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_652d7ff66093e86dc79aa45711b99f7dfdcf7a2501|<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idpr3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e20f43530af84efaaf7f001d4ecc0f6f|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|">https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idpr3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e20f43530af84efaaf7f001d4ecc0f6f|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|</a></p>
<p>uid,mail,<b>eduPersonTargetedID</b>,eduPersonPrincipalName|cypRgyH6cq0Iifq1UFZGlgCKLDA=|_f4d649d8cada1f44d2efa5ff53ff3324|<br>
</p>
<p>regards .<br>
</p>
<p><br>
</p>
</body>
</html>