<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Matthew, thank you for your reply. I made the changes as suggested by you, restarted the service, but the problem persist. I am appending a few lines from the idp-process.log file for your perusal.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
With regards, Francis</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2021-02-03 15:10:48,848 - 10.0.7.7 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
<div>2021-02-03 15:10:48,850 - 10.0.7.7 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set</div>
<div>2021-02-03 15:10:48,850 - 10.0.7.7 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested</div>
<div>2021-02-03 15:10:48,850 - 10.0.7.7 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:312] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow</div>
<div>2021-02-03 15:10:48,851 - 10.0.7.7 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed</div>
<div>2021-02-03 15:10:49,046 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain'
on OUTBOUND message context</div>
<div>2021-02-03 15:10:49,047 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div>
<div>2021-02-03 15:10:49,069 - 10.0.7.7 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:78] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</div>
<div>2021-02-03 15:10:49,092 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete</div>
<div>2021-02-03 15:10:49,093 - 10.0.7.7 - INFO [Shibboleth-Audit.SSO:282] - 10.0.7.7|2021-02-03T09:40:19.339283Z,2021-02-03T09:40:19.083539Z|2021-02-03T09:40:49.093209Z||https://iam.atypon.com/shibboleth|||||||false|false||POST|POST||Requester|urn:oasis:names:tc:SAML:2.0:status:AuthnFailed||Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36</div>
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Matthew Slowe <Matthew.Slowe@jisc.ac.uk><br>
<b>Sent:</b> 03 February 2021 14:28<br>
<b>To:</b> Francis Jayakanth <francis@iisc.ac.in><br>
<b>Cc:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Azure AD and shibboleth IdP integration</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">External Email<br>
<br>
<br>
Hi Francis,<br>
<br>
It looks like the c14n (canonicalisation) flows aren't picking up a suitable subject for some reason.<br>
<br>
Following Chris's guide, when doing pure proxying, we've noticed that you also need to enable (uncomment) this bean in subject-c14n.xml:<br>
<br>
<bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /><br>
<br>
Try that (and restart) and see if it sorts it.<br>
<br>
Regards,<br>
--<br>
Matthew Slowe (GPG: 0x6BE0CF7D04600314)<br>
Senior Technical Consultant and Support specialist - Trust & Identity, Jisc<br>
Team: 0300 300 2212, option 2<br>
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG<br>
<br>
> On 2 Feb 2021, at 16:29, Francis Jayakanth <francis@iisc.ac.in> wrote:<br>
><br>
> Hi Mathew, thank you for your reply. We are still struggling to configure and integrate our IdP 4.0.1 with the Azure AD. I just wanted to let you know that I can access the IEEE platform with the existing IdP configuration. Except for IEEE, the rest of the
platforms are reporting an error.<br>
><br>
> As suggested by you, I have enabled the DEBUG mode of logging, and the corresponding error log file is accessible at the link given below. I request you to have a look at the log file and give your valuable suggestions to overcome the issues.<br>
><br>
> Thanks, and regards, Francis<br>
><br>
> idp-process.log<br>
> From: Matthew Slowe <Matthew.Slowe@jisc.ac.uk><br>
> Sent: 01 February 2021 16:22<br>
> To: Shib Users <users@shibboleth.net><br>
> Cc: Francis Jayakanth <francis@iisc.ac.in><br>
> Subject: Re: Azure AD and shibboleth IdP integration<br>
><br>
> External Email<br>
><br>
><br>
> > On 1 Feb 2021, at 06:00, Raja V, Scientist - C (CS) <raja@inflibnet.ac.in> wrote:<br>
> ><br>
> > Hi,<br>
> > We are trying to integrate Azure AD with shibboleth by following document available athttps://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD<br>
> ><br>
> > However, after authentication, we are getting the following error. Can anyone help us out?<br>
> ><br>
> > ...snip...<br>
> > [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed<br>
><br>
> Hi,<br>
><br>
> At a guess, you're not getting the attribute you expect either because it's not mapped correctly (Proxy Task 3) or the Attribute Filter isn't allowing the incoming attributes in the filter through (Proxy Task 2).<br>
><br>
> It's probably worth turning up the logging to DEBUG and following it through looking for where the attributes either aren't found or are filtered out.<br>
><br>
> I might be wrong though!<br>
> --<br>
> Matthew Slowe (GPG: 0x6BE0CF7D04600314)<br>
> Senior Technical Consultant and Support specialist - Trust & Identity, Jisc<br>
> Team: 0300 300 2212, option 2<br>
> Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG<br>
<br>
</div>
</span></font></div>
</body>
</html>