<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hello,<br>
I'm experiencing issues with Shibboleth 4. It doesn't accept "<i>urn:mace:shibboleth:1.0:nameIdentifier</i>"
namePolicy.<br>
Did someone successfully made a
urn:mace:shibboleth:1.0:nameIdentifier return a transient id ?<br>
<br>
I don't known, as SAML1NameIdentifier and SAML2NameID doesn't
exist anymore on AttributeDefinition/xsi:type on 4.x, how to to
provide both urn:mace:shibboleth:1.0:nameIdentifier and
urn:oasis:names:tc:SAML:2.0:nameid-format:transient on SAMLv2 as
we have several services requesting this old value.<br>
<br>
Some advices would be very very appreciated as i spend the whole
day exploring all Shibb 4 doc not findind any tiny path.<br>
<br>
See below my current conf.<br>
I use internet2's Shibboleth 4.0.1
(<a class="moz-txt-link-freetext" href="https://hub.docker.com/r/tier/shib-idp">https://hub.docker.com/r/tier/shib-idp</a>)<br>
<br>
Everything else is working very well.<br>
<br>
Sorry for my english,<br>
Thanks,<br>
Louis<br>
<br>
<u>Request from SP</u><br>
<br>
shib-idp;idp-process.log;dev;nothing;<?xml version="1.0"
encoding="UTF-8"?><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="xxxxx"
Destination=<a class="moz-txt-link-rfc2396E" href="https://yyyyy.fr/idp/profile/SAML2/Redirect/SSO">"https://yyyyy.fr/idp/profile/SAML2/Redirect/SSO"</a>
ID="ONELOGIN_3df62681-dffc-41e5-8522-251dd0165329"
IssueInstant="2021-01-07T16:48:13Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
ProviderName="yyyy" Version="2.0"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br>
shib-idp;idp-process.log;dev;nothing;
<saml:Issuer><a class="moz-txt-link-freetext" href="https://xxxx">https://xxxx</a></saml:Issuer><br>
shib-idp;idp-process.log;dev;nothing; <samlp:NameIDPolicy
AllowCreate="true"
Format="urn:mace:shibboleth:1.0:nameIdentifier"/><br>
shib-idp;idp-process.log;dev;nothing;
<samlp:RequestedAuthnContext Comparison="exact"><br>
shib-idp;idp-process.log;dev;nothing;
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef><br>
shib-idp;idp-process.log;dev;nothing;
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef><br>
shib-idp;idp-process.log;dev;nothing;
</samlp:RequestedAuthnContext><br>
shib-idp;idp-process.log;dev;nothing;</samlp:AuthnRequest><br>
<br>
<u>Problem starts here:</u><br>
<br>
shib-idp;idp-process.log;dev;nothing;2021-01-07 17:19:03,128 -
172.17.0.1 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:111]
- Profile Action AddAttributeStatementToAssertion: Adding
constructed AttributeStatement to Assertion
_4a13c09af3bd47eac716494229bf5b8b<br>
shib-idp;idp-process.log;dev;nothing;2021-01-07 17:19:03,150 -
172.17.0.1 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] -
Profile Action AddNameIDToSubjects: Request specified use of an
unsupportable identifier format:
urn:mace:shibboleth:1.0:nameIdentifier<br>
<b>shib-idp;idp-warn.log;dev;nothing;2021-01-07 17:19:03,150 -
172.17.0.1 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] -
Profile Action AddNameIDToSubjects: Request specified use of an
unsupportable identifier format:
urn:mace:shibboleth:1.0:nameIdentifier</b><b><br>
</b><br>
<u>And the IDP return an login error</u><br>
<br>
shib-idp;idp-process.log;dev;nothing; <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><br>
shib-idp;idp-process.log;dev;nothing;
<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/><br>
shib-idp;idp-process.log;dev;nothing;
</saml2p:StatusCode><br>
shib-idp;idp-process.log;dev;nothing;
<saml2p:StatusMessage>An error
occurred.</saml2p:StatusMessage><br>
shib-idp;idp-process.log;dev;nothing; </saml2p:Status><br>
<br>
<u>I have the following conf:</u><br>
<br>
[saml-nameid.xml]<br>
<!-- SAML 2 NameID Generation --><br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
<br>
<ref bean="shibboleth.SAML2TransientGenerator" /><br>
<br>
<!-- Uncommenting this bean requires configuration in
saml-nameid.properties. --><br>
<ref bean="shibboleth.SAML2PersistentGenerator" /><br>
<br>
<bean
parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
<bean
parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:mace:shibboleth:1.0:nameIdentifier"<br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
</util:list><br>
<br>
<!-- SAML 1 NameIdentifier Generation --><br>
<util:list
id="shibboleth.SAML1NameIdentifierGenerators"><br>
<br>
<ref bean="shibboleth.SAML1TransientGenerator" /><br>
<br>
<!--<br>
<bean
parent="shibboleth.SAML1AttributeSourcedGenerator"<br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
--><br>
<br>
</util:list><br>
<br>
[saml-nameid.conf]<br>
idp.transientId.generator = shibboleth.CryptoTransientIdGenerator<br>
<br>
tried:<br>
idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier<br>
idp.nameid.saml2.default = urn:mace:shibboleth:1.0:nameIdentifier<br>
<br>
without success<br>
<br>
I tried to send invalid data, conf file works well, nameid
generators looks loaded<br>
<br>
<bean
parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:mace:shibboleth:1.0:nameIdentifier"<br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
shib-idp;idp-process.log;dev;nothing;2021-01-07 17:20:54,541 -
172.17.0.1 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:191]
- Checking for source attribute mail<br>
shib-idp;idp-process.log;dev;nothing;2021-01-07 17:20:54,542 -
172.17.0.1 - INFO
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:221]
- Attribute sources [mail] did not produce a usable identifier<br>
shib-idp;idp-process.log;dev;nothing;2021-01-07 17:20:54,542 -
172.17.0.1 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] -
Profile Action AddNameIDToSubjects: Request specified use of an
unsupportable identifier format:
urn:mace:shibboleth:1.0:nameIdentifier<br>
shib-idp;idp-warn.log;dev;nothing;2021-01-07 17:20:54,542 -
172.17.0.1 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] -
Profile Action AddNameIDToSubjects: Request specified use of an
unsupportable identifier format:
urn:mace:shibboleth:1.0:nameIdentifier<br>
shib-idp;idp-process.log;dev;nothing;2021<br>
<br>
i think I have all the mandatory declaration:<br>
<br>
./metadata/idp-metadata.xml:
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br>
./metadata/idp-metadata.xml:
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br>
./dist/conf/saml-nameid.properties:#idp.nameid.saml1.default =
urn:mace:shibboleth:1.0:nameIdentifier<br>
./dist/conf/audit.xml: <entry
key="urn:mace:shibboleth:1.0:nameIdentifier" value="transient"
/><br>
./system/flows/saml/saml-abstract-beans.xml:
<value>urn:mace:shibboleth:1.0:nameIdentifier</value><br>
./system/flows/saml/saml1/sso-abstract-beans.xml:
p:defaultFormat="%{idp.nameid.saml1.default:urn:mace:shibboleth:1.0:nameIdentifier}"
/><br>
./system/flows/admin/resolvertest-beans.xml:
p:defaultFormat="%{idp.nameid.saml1.default:urn:mace:shibboleth:1.0:nameIdentifier}"><br>
./system/conf/subject-c14n-system.xml: p:formats="#{
{'urn:mace:shibboleth:1.0:nameIdentifier'} }" /><br>
./system/conf/subject-c14n-system.xml: p:formats="#{
{'urn:mace:shibboleth:1.0:nameIdentifier'} }" /><br>
./conf/saml-nameid.xml:
p:format="urn:mace:shibboleth:1.0:nameIdentifier"<br>
./conf/saml-nameid.properties:idp.nameid.saml1.default =
urn:mace:shibboleth:1.0:nameIdentifier<br>
./conf/saml-nameid.properties:idp.nameid.saml2.default =
urn:mace:shibboleth:1.0:nameIdentifier<br>
./conf/audit.xml: <entry
key="urn:mace:shibboleth:1.0:nameIdentifier" value="transient"
/><br>
</p>
</body>
</html>