<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">I'm sorry for giving you enough information.</div><div dir="ltr"><br></div><div dir="ltr">I'd like to send SAML Response including</div><div dir="ltr">NameID as format "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",</div><div dir="ltr">so defined saml-nameid.xml as described below:</div><div dir="ltr"><br></div><div dir="ltr"><util:list id="shibboleth.SAML2NameIDGenerators"></div><div dir="ltr"> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div dir="ltr"> p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</div><div dir="ltr"> p:attributeSourceIds="#{ {'ImmutableID'} }" /></div><div dir="ltr"></util:list></div><div dir="ltr"><br></div><div dir="ltr">And then, Office365 that I'd like to send SAML Response to requires</div><div dir="ltr">two attributes "UserPrincipalName" and "ImmutableID".</div><div dir="ltr">UserPrincipalName is username which identifies a user in Office365.</div><div dir="ltr">ImmutableID is one which identifies a user in whole office365 tenants</div><div dir="ltr">for single-sign-on.So I defined attribute-filter.xml as described below.</div><div dir="ltr"><br></div><div dir="ltr"><AttributeFilterPolicy id="PolicyForOffice365"></div><div dir="ltr"> <PolicyRequirementRule xsi:type="Requester" value="urn:federation:MicrosoftOnline"/></div><div dir="ltr"><br></div><div dir="ltr"> <AttributeRule attributeID="o365UserPrincipalName"></div><div dir="ltr"> <PermitValueRule xsi:type="ANY"/></div><div dir="ltr"> </AttributeRule></div><div dir="ltr"><br></div><div dir="ltr"> <AttributeRule attributeID="ImmutableID"></div><div dir="ltr"> <PermitValueRule xsi:type="ANY"/></div><div dir="ltr"> </AttributeRule></div><div dir="ltr"><br></div><div dir="ltr"> <AttributeRule attributeID="transientId"></div><div dir="ltr"> <DenyValueRule xsi:type="ANY" /></div><div dir="ltr"> </AttributeRule></div><div dir="ltr"></AttributeFilterPolicy></div><div dir="ltr"><br></div><div dir="ltr">I defined attribute-resolver.xml as described as below.</div><div dir="ltr"><br></div><div dir="ltr"><AttributeDefinition id="o365UserPrincipalName" xsi:type="Simple" sourceAttributeID="mail"></div><div dir="ltr"> <Dependency ref="myLDAP" /></div><div dir="ltr"> <AttributeEncoder xsi:type="SAML2String" name="IDPEmail" friendlyName="UserId" /></div><div dir="ltr"></AttributeDefinition></div><div dir="ltr"><br></div><div dir="ltr"><AttributeDefinition id="ImmutableID" xsi:type="Simple" sourceAttributeID="uid"></div><div dir="ltr"> <Dependency ref="myLDAP" /></div><div dir="ltr"> <AttributeEncoder xsi:type="SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /></div><div dir="ltr"></AttributeDefinition></div><div dir="ltr"><br></div><div dir="ltr">ImmutableID is an attribute I have to send Office365 as NameID, and</div><div dir="ltr">it requires format "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".</div><div dir="ltr"><br></div><div dir="ltr">When not using multi-factor authentication(define "idp.authn.flows= password" in idp.properties),</div><div dir="ltr">it works fine.</div><div dir="ltr"><br></div><div dir="ltr">But when using multi-factor authentication(define "idp.authn.flows= MFA" in idp.properties),</div><div dir="ltr">it does not work as I expected.</div><div dir="ltr"><br></div><div dir="ltr">Exactly, after authenticated via Shibboleth IdP, I got the following error shown on Office365:</div><div dir="ltr"><br></div><div dir="ltr">AADSTS500082: SAML assertion is not present in the token.</div><div dir="ltr"><br></div><div dir="ltr">I picked up some errors from idp-process.log that may causes the above-mentioned error.</div><div dir="ltr"><br></div><div dir="ltr">2019-02-03 15:26:47,463 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects</div><div dir="ltr">2019-02-03 15:26:47,465 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:215] - Applying policy to NameIDPolicy with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</div><div dir="ltr">2019-02-03 15:26:47,466 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile Action AddNameIDToSubjects: Request specified NameID format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</div><div dir="ltr">2019-02-03 15:26:47,467 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</div><div dir="ltr">2019-02-03 15:26:47,468 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</div><div dir="ltr">2019-02-03 15:26:47,469 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197] - Checking for source attribute ImmutableID</div><div dir="ltr">2019-02-03 15:26:47,470 - INFO [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227] - Attribute sources [ImmutableID] did not produce a usable identifier</div><div dir="ltr">2019-02-03 15:26:47,470 - DEBUG [org.opensaml.saml.saml2.profile.AbstractSAML2NameIDGenerator:92] - No identifier to use</div><div dir="ltr">2019-02-03 15:26:47,471 - WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:per</div><div dir="ltr">sistent</div><div dir="ltr">2019-02-03 15:26:47,496 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy</div><div dir="ltr">2019-02-03 15:26:47,497 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event InvalidNameIDPolicy will be handled with response</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">I found the following statement in SAML Response which was sent to Office365 in idp-process.log.</div><div dir="ltr"><br></div><div dir="ltr"><saml2p:Status></div><div dir="ltr"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"></div><div dir="ltr"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></div><div dir="ltr"> </saml2p:StatusCode></div><div dir="ltr"> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage></div><div dir="ltr"></saml2p:Status></div><div dir="ltr"><br></div><div dir="ltr">Are there enough informations to solve this problem?</div><div><br></div></div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">2019年2月2日(土) 3:21 Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">> Do you have any solutions?<br>
<br>
That's a virtually impossible scenario, so either you're mistaking the actual situation, or you have strangely different attribute resolution outcomes depending on how authentication was done. It's possible authentication isn't working at all and it may be mis-reporting the wrong error status in the resulting message, but I don't think it would do that.<br>
<br>
You provided no logs or specifics, so nothing to base any informed guess on.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><div><br></div></div></div>