<div dir="ltr"><div>Grrr -- I should have check that, apologies -- you are right.</div><div><br></div><div>Via SAML Trace --- it's not being sent.</div><div><br></div><div> <span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><</span></span><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name">saml2:Subject</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">></span></span></span>
<span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><</span></span><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name">saml2:SubjectConfirmation</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"> </span></span><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr">Method</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">=</span></span><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string">"urn:oasis:names:tc:SAML:2.0:cm:bearer"</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">></span></span></span>
<span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><</span></span><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name">saml2:SubjectConfirmationData</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"> </span></span><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr">Address</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">=</span></span><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string">""</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">
</span></span><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr">InResponseTo</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">=</span></span><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string">"id2563797135943584976540087"</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">
</span></span><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr">NotOnOrAfter</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">=</span></span><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string">"2018-08-02T14:51:10.924Z"</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">
</span></span><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr"><span class="gmail-hljs-tag"><span class="gmail-hljs-attr">Recipient</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">=</span></span><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string"><span class="gmail-hljs-tag"><span class="gmail-hljs-string">"<a href="https://adbe-016336715ad681bc0a495e8a-36b2-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-016336715ad681bc0a495e8a-36b2-prd.okta.com/auth/saml20/accauthlinktest</a>"</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">
/></span></span></span>
<span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"></</span></span><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name">saml2:SubjectConfirmation</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">></span></span></span>
<span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"></</span></span><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name"><span class="gmail-hljs-tag"><span class="gmail-hljs-name">saml2:Subject</span></span></span></span></span><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">></span></span></span></div><div><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><br></span></span></span></div><div><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag">Any ideas where else to investigate? The Adobe help did not seem to know what's next and taking us on a wild-goose chase.<br></span></span></span></div><div><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"><span class="gmail-hljs-tag"></span></span></span><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 2, 2018 at 7:42 AM, Boyd, Todd M. <span dir="ltr"><<a href="mailto:tmboyd1@ccis.edu" target="_blank">tmboyd1@ccis.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">You can truly validate that it is being sent if you turn on debugging for the assertions. You will see the SAML response in its entirety--you can even see it before encryption takes place if you turn on debugging for encryption.<br>
<br>
______________________________<wbr>__<br>
From: users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Jann Malenkoff <<a href="mailto:jannmalenkoff@gmail.com">jannmalenkoff@gmail.com</a>><br>
Sent: Thursday, August 2, 2018 9:30:33 AM<br>
To: Shib Users<br>
Subject: Re: Adobe SSO<br>
<span class=""><br>
Thank you Peter!<br>
<br>
The following appears in the logs -- can I assume that it is being sent?<br>
<br>
2018-08-02 07:24:43,513 - DEBUG [net.shibboleth.idp.saml.<wbr>profile.impl.<wbr>ExtractSubjectFromRequest:144] - [<wbr>48DD30BAA780B9437CF580FB2FC1F1<wbr>23] - [] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing<br>
2018-08-02 07:24:58,422 - DEBUG [net.shibboleth.idp.saml.<wbr>profile.logic.<wbr>DefaultNameIdentifierFormatStr<wbr>ategy:124] - [<wbr>48DD30BAA780B9437CF580FB2FC1F1<wbr>23] - [] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:emailAddress]<br>
2018-08-02 07:24:58,422 - DEBUG [net.shibboleth.idp.saml.<wbr>profile.logic.<wbr>DefaultNameIdentifierFormatStr<wbr>ategy:145] - [<wbr>48DD30BAA780B9437CF580FB2FC1F1<wbr>23] - [] - Filtered non-metadata-supported formats from configured formats, leaving: [urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:emailAddress]<br>
<br>
</span>On Thu, Aug 2, 2018 at 5:13 AM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a><<wbr>mailto:<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.<wbr>ac.at</a>>> wrote:<br>
* Jann Malenkoff <<a href="mailto:jannmalenkoff@gmail.com">jannmalenkoff@gmail.com</a><<wbr>mailto:<a href="mailto:jannmalenkoff@gmail.com">jannmalenkoff@gmail.com</a><wbr>>> [2018-08-02 09:24]:<br>
<div><div class="h5">> We have the following configure -- but for the life of me can't figure out<br>
> why the NameID is not sent --- can anyone spot anything obvious we missed?<br>
><br>
> RELYING-PARTY.XML<br>
> p:nameIDFormatPrecedence="#{{'<wbr>urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:emailAddress'}}"<br>
<br>
If you control a local copy of the SP's metadata (as you do) you don't<br>
need to override the NameIDFormat here. The IDP uses what's listed<br>
first in metadata.<br>
<br>
> ADOBE METADATA IMPORTED<br>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:<wbr>SAML:2.0:metadata"<br>
> entityID="<a href="https://www.okta.com/saml2/service-provider/" rel="noreferrer" target="_blank">https://www.okta.<wbr>com/saml2/service-provider/</a>"><br>
<br>
Hardly "ADOBE METADATA", btw.<br>
<br>
> <md:KeyDescriptor use="signing"><br>
<br>
Assuming the metadata you sent was complete that means your IDP will<br>
not even interop with that SP due to a lack of a key usable for<br>
encryption -- unless you have globally set idp.encryption.optional in<br>
your conf/idp.properties.<br>
<br>
But encrypting NameIDs defaults to off for many many years now, so the<br>
only thing this should affect (if the IDP completes SSO at all) are<br>
the attributes you send along (FirstName, LastName, Email).<br>
Which is not what this question of yours is about.<br>
<br>
> <md:NameIDFormat>urn:oasis:<wbr>names:tc:SAML:1.1:nameid-<wbr>format:emailAddress</md:<wbr>NameIDFormat><br>
<br>
Having that in the metadata will suffice.<br>
<br>
> SAML-NAMEID.XML<br>
> <bean parent="shibboleth.<wbr>SAML2AttributeSourcedGenerator<wbr>"<br>
><br>
> p:format="urn:oasis:names:tc:<wbr>SAML:1.1:nameid-format:<wbr>emailAddress"<br>
> p:attributeSourceIds="#{ {'Email'} }" /><br>
<br>
I'd add p:omitQualifiers="true" there for good measure but otherwise<br>
that looks OK.<br>
<br>
> ATRIBUTE-FILTER.XML<br>
><br>
> <AttributeFilterPolicy id="<a href="https://www.okta.com/saml2/service-provider/" rel="noreferrer" target="_blank">https://www.okta.com/<wbr>saml2/service-provider/</a>"><br>
> <PolicyRequirementRule xsi:type="Requester" value="<a href="https://www.okta.com/saml2/service-provider/" rel="noreferrer" target="_blank">https://www.okta.com/<wbr>saml2/service-provider/</a>"/><br>
[...]<br>
> <AttributeRule attributeID="Email"><br>
> <PermitValueRule xsi:type="ANY" /><br>
> </AttributeRule><br>
> </AttributeFilterPolicy><br>
<br>
OK.<br>
<br>
> ATTRIBUTE-RESOLVER.XML<br>
> <resolver:AttributeDefinition id="Email" xsi:type="ad:Simple" sourceAttributeID="mail"><br>
> <resolver:Dependency ref="myLDAP" /><br>
> <resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>unspecified"<br>
> name="Email" encodeType="false" /><br>
> </resolver:<wbr>AttributeDefinition><br>
<br>
Unless the SP positively requires that nameformat (and you've verfied<br>
that empirically, which you only can once you got it working with the<br>
nonsensical format, and then work back from that) just leave the<br>
default as per conf/attribute-resolver-full.<wbr>xml, for of these<br>
attributes.<br>
<br>
TL;DR: Nothing really sticks out. You can always up the log level and<br>
watch what gets set as NameID and what not, and why.<br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
</div></div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><mailto:<a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@<wbr>shibboleth.net</a>><br>
<div class="HOEnZb"><div class="h5"><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>