<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Thanks for your reply.</div><div><br></div><div>> Happened? You’ll need a log of the attribute resolution. My guess would be that the principal is different in the two cases and when you present that to LDAP it doesn’t resolve...<br></div><div><br></div><div>What does "the principal is different in the two cases" means?</div><div><br></div><div>I found out that the other attributes except "ImmutableID" can be resolved from idp-process.log as below.</div><div><br></div>2019-02-04 00:34:06,103 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] - Data Connector 'myLDAP': Attribute 'mail': Values '[StringAttributeValue{value=<a href="mailto:XXX@example.com">XXX@example.com</a>}]'<br>2019-02-04 00:34:06,104 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] - Data Connector 'myLDAP': Attribute 'displayName': Values '[StringAttributeValue{value=XXX XXX}]'<br>2019-02-04 00:34:06,105 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] - Data Connector 'myLDAP': Attribute 'givenName': Values '[StringAttributeValue{value=XXX}]'</div><div dir="ltr"><br></div><div>In addition, I use two flows which consists of "anthn/Password" and "authn/Totp".</div><div><br></div><div>"Auntn/Totp" is one I developed.In this case,Office365 requires to pass both flows.</div><div><br></div><div>(1) To enable above-mentioned flows, I defined idp.properties as follows.</div>idp.authn.flows= MFA|Password</div>idp.authn.favorSSO = false</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><div>(2) I defined /opt/shibboleth-idp/conf/relying-party.xml as below.</div><div dir="ltr"><div dir="ltr"><bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div><div dir="ltr"><br></div><div dir="ltr"><bean id="TotpPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Totp" /></div><div dir="ltr"><br></div><div dir="ltr"><util:list id="shibboleth.RelyingPartyOverrides"></div><div dir="ltr"> </div><div dir="ltr"> <bean parent="RelyingPartyByName" c:relyingPartyIds="urn:federation:MicrosoftOnline"></div><div dir="ltr"> <property name="profileConfigurations"></div><div dir="ltr"> <list></div><div dir="ltr"> <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"></div><div dir="ltr"> <property name="defaultAuthenticationMethods"></div><div dir="ltr"> <list></div><div dir="ltr"> <ref bean="TotpPrincipal" /></div><div dir="ltr"> <ref bean="PasswordPrincipal" /></div><div dir="ltr"> </list></div><div dir="ltr"> </property></div><div dir="ltr"> </bean></div><div dir="ltr"> </list></div><div dir="ltr"> </property></div><div dir="ltr"> </bean></div><div dir="ltr"></util:list></div></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">(3) I defined /opt/shibboleth-idp/system/conf/general-authn-system.xml as below.<br><entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Totp" value="125" /><br></div></div><div dir="ltr"><br></div><div dir="ltr">(4) I defined /opt/shibboleth-idp/conf/authn/general-authn.xml as below.<br></div><div dir="ltr"><div dir="ltr"><!-- Add TOTP --></div><div dir="ltr"><bean id="authn/Totp" parent="shibboleth.AuthenticationFlow"</div><div dir="ltr"> p:passiveAuthenticationSupported="true"</div><div dir="ltr"> p:forcedAuthenticationSupported="true"></div><div dir="ltr"> <property name="supportedPrincipals"></div><div dir="ltr"> <list></div><div dir="ltr"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Totp" /></div><div dir="ltr"> </list></div><div dir="ltr"> </property></div><div dir="ltr"></bean></div><div dir="ltr"><br></div><div dir="ltr"><bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"</div><div dir="ltr"> p:passiveAuthenticationSupported="true"</div><div dir="ltr"> p:forcedAuthenticationSupported="true"></div><div dir="ltr"> <!--</div><div dir="ltr"> The list below almost certainly requires changes, and should generally be the</div><div dir="ltr"> union of any of the separate factors you combine in your particular MFA flow</div><div dir="ltr"> rules. The example corresponds to the example in mfa-authn-config.xml that</div><div dir="ltr"> combines IPAddress with Password.</div><div dir="ltr"> --></div><div dir="ltr"> <property name="supportedPrincipals"></div><div dir="ltr"> <list></div><div dir="ltr"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /></div><div dir="ltr"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div><div dir="ltr"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div><div dir="ltr"> <bean parent="shibboleth.SAML1AuthenticationMethod"</div><div dir="ltr"> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /></div><div dir="ltr"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div dir="ltr"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Totp" /></div><div dir="ltr"> </list></div><div dir="ltr"> </property></div><div dir="ltr"></bean></div><div dir="ltr"><br></div><div dir="ltr"></util:list></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">2019年2月3日(日) 16:22 Rod Widdowson <<a href="mailto:rdw@steadingsoftware.com">rdw@steadingsoftware.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Did you chase up why this<br>
<br>
> [INFO]net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227] - Attribute sources [ImmutableID] did not produce a usable identifier<br>
<br>
Happened? You’ll need a log of the attribute resolution. My guess would be that the principal is different in the two cases and when you present that to LDAP it doesn’t resolve...<br>
<br>
Rod<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br clear="all"><div><br></div></div>