<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I don’t know if this was your issue, but we literally did this yesterday, and for us it was that you must release the attributes used to calculate the Name ID.
The log pretty much said that, but I don’t remember if it required debug to say it (I leave some debug on to help with troubleshooting helpdesk issues, and they haven’t caused an issue). Adobe told us the attribute names were case sensitive, and releasing
“Email” did not allow the email Name ID to be calculated because our configuration used “email” to calculate it. I released both and it worked.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Also the initial setup on Adobe’s side using our SHA1 certificate did not provide an encryption key in the Adobe metadata and I had to disable encrypted assertions
(and encrypted Name ID, though maybe that wasn’t required) on our side for it to work. Once they loaded our SHA256 certificate, their metadata included an encryption key.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Jason Brady * Web Developer * San Bernardino Community College District *
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">1289 Bryn Mawr Ave, Suite B, Redlands, CA 92374 *<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Tel 909-384-8691 * Mobile 951-295-9515 * Fax 909-796-6579 *
<a href="mailto:jbrady@sbccd.cc.ca.us"><span style="color:#0563C1">jbrady@sbccd.cc.ca.us</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Jann Malenkoff<br>
<b>Sent:</b> Thursday, August 2, 2018 11:19 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Adobe SSO<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">As always -- this mailing list has the direction and/or answers -- thank you :)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There were a number of events (on NameID generation, attribute resolution unsupported by Adobe - per suggestion by Peter and Todd) -- culminating with Scott's suggestion -- w.r.t attribute release.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you all.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We were on a wild-goose chase for many weeks with the vendor -- I have learned my lesson to come here earlier in future.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Aug 2, 2018 at 8:23 AM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">(And I'd add that once the logging is clear, I'd suggest filing a RFE because it shouldn't be necessary to run on DEBUG to diagnose this. Any generators that aren't able to run when they're asked to should probably log themselves on INFO.
They may already.)<br>
<span style="color:#888888"><br>
<span class="hoenzb">-- Scott</span></span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
> -----Original Message-----<br>
> From: Cantor, Scott<br>
> Sent: Thursday, August 2, 2018 11:21 AM<br>
> To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
> Subject: RE: Adobe SSO<br>
> <br>
> > Any ideas where else to investigate?<br>
> <br>
> The log. It tells you exactly what it does at every step of the generation<br>
> process and I can mostly guarantee it's telling you that your requested<br>
> format was impossible to satisfy with anything you have configured or that<br>
> no data was available to populate it from the sourced IdPAttribute.<br>
> <br>
> -- Scott<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>