<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">To all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I'm having an unusual issue getting Shibboleth to authenticate with WebEx. Essentially, I have two WebEx instances (test and production) and two Shibboleth instances (also test and production). My test-Shibboleth to test-WebEx integration
works fine, and so far as I can tell, the configuration of the two Shibboleth instances are identical in terms of configuration. Nevertheless, my production Shibboleth instance refuses to send a complete SAML assertion to the production WebEx instance; specifically,
it's refusing to add the NameID. Here's what happed the last time I attempted this with production-Shibboleth talking to production-WebEx:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,764 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,765 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,766 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified' format<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,767 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,767 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:117] - Metadata did not specify any formats, relying on configuration alone<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,768 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,768 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,769 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-21 02:59:15,770 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As you can see, it's NOT able to generate a NameID. The same thing on the test-Shibboleth to test-WebEx goes like this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,100 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,101 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,101 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified' format<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,102 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,102 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:117] - Metadata did not specify any formats, relying on configuration alone<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,103 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,103 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,104 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,104 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197] - Checking for source attribute WebExEmail<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,104 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:216] - Generating NameID from String-valued attribute WebExEmail<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,105 - DEBUG [org.opensaml.saml.saml2.profile.AbstractSAML2NameIDGenerator:96] - Generating NameID Ernie.Kinsey@cpcc.edu with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,105 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118] - Successfully generated identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,106 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:400] - Profile Action AddNameIDToSubjects: Successfully generated NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<o:p></o:p></p>
<p class="MsoNormal"> 2018-09-25 10:29:55,106 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:358] - Profile Action AddNameIDToSubjects: Added NameID to 1 assertion subject(s)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…. Where there’s absolutely no problem generating a NameID. Keeping in mind that the two Shibboleth configurations match, and that when I try this, the admin panel for the two WebEx instances also match, I'm at a loss to understand how
in the world this is happening. Finally, I engaged with Cisco to compare the test and production WebEx instance to one another on the off chance there’s was something about how they’re set up that isn’t matching – but this didn’t show any differences of the
sort that might be relevant.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I've seen references to the general issue of a NameID not being generated (most of them having to do with the saml-nameid.xml file), but so far as I can tell, none of the problem resolutions I saw describe things in my Shibboleth configuration.
Any suggestions about other things I might check would be very much appreciated; even better, if someone's had an experience like this, any information about how that was resolved would be a huge help.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Ernest K. Kinsey, Jr.<o:p></o:p></p>
<p class="MsoNormal">Central Piedmont Community College<o:p></o:p></p>
<p class="MsoNormal">Charlotte, NC 28211<o:p></o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use
of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.<br>
</font>
</body>
</html>