<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.dcouriernew
{mso-style-name:dcouriernew;}
span.highlight
{mso-style-name:highlight;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE-AT" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello Nate,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">first of all – thank you very much for your answer!
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Our Application use
</span>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent and i think you are right, the IDP cant handle it.
<o:p></o:p></p>
<p class="MsoNormal"><br>
I think you are right, the saml-nameid.xml ist not correct oft that.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
With IDP2 our Configuration was this: <o:p></o:p></p>
<p><span class="dcouriernew"> <resolver:AttributeEncoder xsi:type="</span><span class="highlight">SAML</span><span class="dcouriernew">1String"
</span><br>
<span class="dcouriernew"> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" </span>
<br>
<span class="dcouriernew"> name="urn:mace:dir:attribute-def:userPrincipalName" /></span><o:p></o:p></p>
<p><span class="dcouriernew"> <resolver:AttributeEncoder xsi:type="</span><span class="highlight">SAML</span><span class="dcouriernew">2String" </span><br>
<span class="dcouriernew"> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" </span>
<br>
<span class="dcouriernew"> name="urn:oid:1.2.840.113556.1.4.656" </span><br>
<span class="dcouriernew"> friendlyName="userPrincipalName" /></span><o:p></o:p></p>
<p><span class="dcouriernew"> <!-- for including the persistent NameID in the response --></span><o:p></o:p></p>
<p><span class="dcouriernew"> <resolver:AttributeEncoder</span><br>
<span class="dcouriernew"> xsi:type="</span><span class="highlight">SAML</span><span class="dcouriernew">1StringNameIdentifier"</span><br>
<span class="dcouriernew"> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" </span>
<br>
<span class="dcouriernew"> nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" /></span><o:p></o:p></p>
<p><span class="dcouriernew"> <resolver:AttributeEncoder xsi:type="</span><span class="highlight">SAML</span><span class="dcouriernew">2StringNameID" </span><br>
<span class="dcouriernew"> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" </span><br>
<span class="dcouriernew"> nameFormat="urn:oasis:names:tc:</span><span class="highlight">SAML</span><span class="dcouriernew">:2.0:nameid-format:persistent" /></span><o:p></o:p></p>
<p class="MsoNormal">But i think, i must „translate“ the code in saml-nameid.xml?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Greetings from Vienna,<br>
Phil<o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="DE">Von:</span></b><span lang="DE"> Nate Klingenstein-5 [via Shibboleth] <ml+s1660669n7648280h95@n2.nabble.com>
<br>
<b>Gesendet:</b> Samstag, 9. Jänner 2021 19:03<br>
<b>An:</b> philip.nemeth@pnem.at<br>
<b>Betreff:</b> RE: Problem with urn:oasis:names:tc:SAML:2.0:nameid-format:persistent?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Phil, <br>
<br>
Odds are that you haven't configured your IdP to be able to send persistent nameID's:
<br>
<br>
> 2021-01-09 15:23:47,561 - 10.10.26.0 - WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
<br>
<br>
As indicated by your snippet of saml-nameid.xml. <br>
<br>
> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
<br>
> <br>
> <!-- <br>
> <br>
> <ref bean="shibboleth.SAML2PersistentGenerator" /> <br>
> <br>
> --> <br>
<br>
As such, the IdP is unable to generate the requested NameID format and meet the policy requirements of the SP with which it's attempting to communicate, causing it to error out. You'll need to follow the appropriate steps to enable the generation of persistent
NameID's. It's a slightly tricky topic, so be sure to follow the documentation closely.
<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP4/PersistentNameIDGenerationConfiguration" target="_top">https://wiki.shibboleth.net/confluence/display/IDP4/PersistentNameIDGenerationConfiguration</a><br>
<br>
If the service actually requires persistent NameID's, then you'll need to go through full configuration and understanding of them. If it doesn't and it's misusing the standard(which is fairly common in deployment), then you can put a hack in place(ill-advised
in most cases), or reconfigure the service's metadata/AuthnRequest to require a different NameID format.
<br>
<br>
Best wishes, <br>
Nate. <br>
<br>
-------- <br>
Signet, Inc. <br>
The Art of Access ® <br>
<br>
<a href="https://www.signet.id" target="_top">https://www.signet.id</a><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_top">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="/user/SendEmail.jtp?type=node&node=7648280&i=0" target="_top">
[hidden email]</a> <br>
<br>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="100%" noshade="" style="color:#CCCCCC" align="center">
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#444444">If you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><a href="https://shibboleth.1660669.n2.nabble.com/WG-Problem-with-urn-oasis-names-tc-SAML-2-0-nameid-format-persistent-tp7648279p7648280.html"><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif">https://shibboleth.1660669.n2.nabble.com/WG-Problem-with-urn-oasis-names-tc-SAML-2-0-nameid-format-persistent-tp7648279p7648280.html</span></a><span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#444444">
<o:p></o:p></span></p>
</div>
<div style="margin-top:4.8pt">
<p class="MsoNormal" style="line-height:18.0pt"><span style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:#666666">To unsubscribe from Shibboleth - Users,
</span><a href="https://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=1660767&code=cC5uZW1AcG5lbS5hdHwxNjYwNzY3fDEyMzU5NDU2OQ=="><span style="font-size:8.5pt;font-family:"Tahoma",sans-serif">click here</span></a><span style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:#666666">.<br>
</span><a href="https://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml"><span style="font-size:7.0pt;font-family:"Times New Roman",serif">NAML</span></a><span style="font-size:8.5pt;font-family:"Tahoma",sans-serif;color:#666666">
<o:p></o:p></span></p>
</div>
</div>
</body>
</html>