<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I’ve been wracking my brain with this over the last several days (not including the weekend, thankfully). I’m trying to get Shib IDP to generate a persistent NameID using our campusPermanentId attribute, but I’m seeing this in the logs:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: [urn:oasis:names:tc:SAML:2.0:nameid<span style="font-family:"Cambria Math",serif">‑</span>format:persistent]<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid<span style="font-family:"Cambria Math",serif">‑</span>format:persistent]<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid<span style="font-family:"Cambria Math",serif">‑</span>format:persistent<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid<span style="font-family:"Cambria Math",serif">‑</span>format:persistent<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There are no errors in the idp-process.log file, so as far as I can tell, it’s not having any issues with the configuration. I uncommented the SAML2PersistentGenerator bean in saml-nameid.xml, and I’ve set the following values in saml-nameid.properties:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">idp.persistentId.sourceAttribute = campusPermanentId<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">idp.persistentId.salt = (some salt value here)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The rest of the file is commented out, relying on defaults, though I’ve tried tweaking those settings to be explicit, as well—such as releasing the attribute to this SP and using filtered attributes as well as specifying the encodedSalt
value.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We release the campusPermanentId attribute to other SPs (and I’ve experimented by releasing the attribute to this particular SP), so I know the attribute is being retrieved and that it does have a value. I’m rather confused as to what could
be the problem. Any suggestions on where else I could check to troubleshoot further?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Todd<o:p></o:p></p>
</div>
</body>
</html>