<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4275">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: Issue with urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"><span style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Hamsa,</span></p><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">There is a lot of configuration there that you probably don't need. If all you want to do is send an attribute as an unspecified NameIDFormat to a particular provider, define that NameIDFormat naming the attributes that you would like to populate it with and add an ActivationCondition that limits its release to that provider. You should be able to fit all of that in a few lines of saml-nameid.xml. A basic example might look like:</div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number17 gmail-index16 gmail-alt2"> <bean<span> </span>parent="<a style="background:none; border-radius:0px; border:0px; color:#003366; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto" href="https://wiki.shibboleth.net/confluence/display/IDP30/shibboleth.SAML2AttributeSourcedGenerator">shibboleth.SAML2AttributeSourcedGenerator</a>"</div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number18 gmail-index17 gmail-alt1"> p:format="urn:oasis:names:tc:SAML:1.1<a style="background:none; border-radius:0px; border:0px; color:#003366; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto">:nameid-format:unspecified</a>"</div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number19 gmail-index18 gmail-alt2"> p:attributeSourceIds="#{ {'username'} }"></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number20 gmail-index19 gmail-alt1"> <property<span> </span>name="activationCondition"></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number21 gmail-index20 gmail-alt2"> <bean<span> </span>parent="<a style="background:none; border-radius:0px; border:0px; color:#003366; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto" href="https://wiki.shibboleth.net/confluence/display/IDP30/shibboleth.Conditions.RelyingPartyId">shibboleth.Conditions.RelyingPartyId</a>"<span> </span>c:candidates="#{{'XXXXXXXXXXXXXXX'}}"<span> </span>/></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number22 gmail-index21 gmail-alt1"> </property></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; white-space:nowrap; width:auto" class="gmail-line gmail-number23 gmail-index22 gmail-alt2"> </bean></div></div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">You will also need to explicitly force the use of unspecified NameID's for that relying party in relying-party.xml.</div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><span style="background-color:#ffffff; border-bottom:1px dashed #cccccc; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial" class="gmail-aBn"><span class="gmail-aQJ">2018-10-16</span></span><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial"><span> </span>10:25:00,979 - WARN</span><br /><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial">[org.opensaml.saml.common.</span><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial">profile.logic.</span><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial">MetadataNameIdentifierFormatSt</span><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial">rategy:?]</span><br /><span style="background-color:#ffffff; font-size:12.8px; text-decoration-color:initial; text-decoration-style:initial">- Ignoring NameIDFormat metadata that includes the 'unspecified' format</span><span> </span></div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22" _src="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22</a></div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number1 index0 alt2"><bean parent="RelyingPartyByName"<span> </span>c:relyingPartyIds="<a style="background:none; border-radius:0px; border:0px; color:#003366 !important; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto" href="https://scroogle.com/">X</a>XXXXXXXXXXXX"></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number2 index1 alt1"> <property name="profileConfigurations"></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number3 index2 alt2"> <list></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number4 index3 alt1"> <bean parent="<a style="background:none; border-radius:0px; border:0px; color:#003366 !important; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto" href="https://wiki.shibboleth.net/confluence/display/IDP30/SAML2.SSO">SAML2.SSO</a>"<span> </span>p:encryptAssertions="false" p:assertionLifetime="PT60M" p:securityConfigurationref="XXXXXXXXX"</div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number5 index4 alt2"> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:<a style="background:none; border-radius:0px; border:0px; color:#003366 !important; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-weight:normal; height:auto; margin:0px; outline:0px; padding:0px; text-align:left; text-decoration:none; width:auto" href="%31.1:nameid-format:unspecified">1.1:nameid-format:unspecified</a>"<span> </span>/></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number6 index5 alt1"> </list></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number7 index6 alt2"> </property></div><div style="background:none #ffffff; border-radius:0px; border:0px; color:#333333; font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace; font-size:14px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; height:auto; margin:0px; outline:0px; padding:0px 1em 0px 0em; text-align:left; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:nowrap; width:auto; word-spacing:0px" class="line number8 index7 alt1"></bean></div></div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">You will almost certainly want to disable the legacy name generators, though it should be uninvolved regardless in this situation.</div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Take care,</div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Nate.</div><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Hamsa<br /><strong>Sent:</strong> Tuesday, October 16 2018, 12:32 pm<br /><strong>To:</strong> users@shibboleth.net<br /><strong>Subject:</strong> Issue with urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<br /> <pre style="white-space:pre-wrap; word-wrap:break-word">Hi,
I am getting Policy checking disabled for NameIDPolicy with Format
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified though I have defined
my bean as below in my relying-party.xml file and I am using activation
condition
<bean id="MyBean" parent="RelyingParty">
<property name="activationCondition"
ref="ServiceNowCondition" />
<property name="responderId" value="XXXXXXXXXX" />
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:assertionLifetime="PT60M"
p:encryptAssertions="false" p:securityConfigurationref="XXXXXXXXX"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/>
</list>
</property>
</bean>
And my SP metadata has
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
And my saml-nameid.xml
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
p:attributeSourceIds="#{ {'username'} }">
<property name="activationCondition">
<bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{{
<!-- my SP entityIDs -->
}}" />
</property>
</bean>
And i have enabled
idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
idp.nameid.saml1.legacyGenerator =
shibboleth.LegacySAML1NameIdentifierGenerator
Please someone guide me in right direction? I have following in my Log,
2018-10-16 10:25:00,978 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:?] - Profile
Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion
Subjects
2018-10-16 10:25:00,979 -DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:?] -
Policy checking disabled for NameIDPolicy with Format
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2018-10-16 10:25:00,979 - WARN
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:?]
- Ignoring NameIDFormat metadata that includes the 'unspecified' format
2018-10-16 10:25:00,982 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:?]
- Configuration specifies the following formats: []
2018-10-16 10:25:00,982 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:?]
- No formats specified in configuration or in metadata, returning default
2018-10-16 10:25:00,982 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:?] - Profile
Action AddNameIDToSubjects: Candidate NameID formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:transient]
2018-10-16 10:25:00,982 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:?] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
2018-10-16 10:25:00,982 -DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:?] -
Trying to generate identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
--
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html</a>
--
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre></blockquote>
</body>
</html>