<div dir="ltr">I have this running in our val environment and ran into that error in the past. For us, it was having to do with Shib not being configured to parse the returned attribute to be used to poll your attribute source.<div><br></div><div>For starters, confirm that you have the c14n/attribute bean uncommented in conf/c14n/subject-c14n.xml. I don't think that's expressly given in the docs.</div><div><br></div><div>-Jeff</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 1, 2021 at 2:33 PM Goggins, Patrick via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-4102916622089996434WordSection1">
<p class="MsoNormal" style="margin-bottom:12pt">Building up a new Shib v4.0.1 IdP (under WS2019) utilizing Azure AD for a hybrid release.<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt">Finished running through the documentation steps a few days ago but running into some issues with crosswalk mapping. I’ve enabled SAML debugging to isolate the issue but not sure where the adjustment needs to
be made.<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New"">2021-03-01 12:37:13,960 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile Action ValidateAssertions: Assertion validation
result was: VALID<br>
2021-03-01 12:37:13,960 - 143.200.128.40 - INFO [Shibboleth-Audit.SSO:282] - 143.200.128.40||2021-03-01T18:37:13.960349500Z||<a href="https://sts.windows.net/7fc34f9d-1f75-4f96-b5b3-3cdcxxxxxxxx/%7C_d92d198a-ea74-4517-babe-37533dae0200%7Cpassword%7C2021-03-01T18:37:04.031Z%7CazureObjectidentifier,azureIdentityprovider,azureGivenname,azureAuthnmethodsreferences,azureDisplayname,azureTenantid,azureEmailaddress,azureSurname%7Csamltest@uwgb.edu%7CemailAddress%7C%7Cfalse%7C%7CRedirect%7CPOST%7C%7CSuccess%7C%7C%7CMozilla/5.0" target="_blank">https://sts.windows.net/7fc34f9d-1f75-4f96-b5b3-3cdcxxxxxxxx/|_d92d198a-ea74-4517-babe-37533dae0200|password|2021-03-01T18:37:04.031Z|azureObjectidentifier,azureIdentityprovider,azureGivenname,azureAuthnmethodsreferences,azureDisplayname,azureTenantid,azureEmailaddress,azureSurname|samltest@uwgb.edu|emailAddress||false||Redirect|POST||Success|||Mozilla/5.0</a>
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36<br>
<span style="background:yellow">2021-03-01 12:37:13,975 - 143.200.128.40 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose
from, canonicalization will fail</span><br>
2021-03-01 12:37:13,975 - 143.200.128.40 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] - Error event NoPotentialFlow will be handled with response<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] - Profile Action AddStatusResponseShell: Setting Issuer to <a href="https://idpdev.uwgb.edu/idp/shibboleth" target="_blank">https://idpdev.uwgb.edu/idp/shibboleth</a><br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile Action AddStatusToResponse: Detailed errors are disabled<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:220] - Profile Action AddStatusToResponse: Setting StatusMessage to defaulted value<br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] - Adding destination to outbound SAML 2 protocol message: <a href="https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST" target="_blank">https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST</a><br>
2021-03-01 12:37:13,975 - 143.200.128.40 - DEBUG [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52] - Message Handler: Checking outbound endpoint for allowed URL scheme: <a href="https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST" target="_blank">https://spdev.uwgb.edu/Shibboleth.sso/SAML2/POST</a><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt">I’m assuming the issue is with Proxy Task 4 which has been setup.<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt">Attribute-resolver set to:<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New""><AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="true" id="canonicalNameToUseForJoin" principalAttributeName="azureName" /><br>
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="mail" principalAttributeName="azureEmailaddress" /><br>
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="displayName" principalAttributeName="azureDisplayname" /><br>
<AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false" id="eduPersonPrincipalName" principalAttributeName="azureName" /><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New"">The two extra definitions to the c14n have been added as well. In this config, I’m hoping to doing a basic release via Azure AD attributes, then add in the rest of the
attributes via ldap to AD locally.<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(0,106,77)">Patrick Goggins<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Arial,sans-serif;color:rgb(0,106,77)">Senior Network/Systems Administrator<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Arial,sans-serif;color:rgb(0,106,77)">............................................................................................<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Arial,sans-serif;color:rgb(0,106,77)">Division of Information Technology<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Arial,sans-serif;color:rgb(0,106,77)">University of Wisconsin – Green Bay</span><span style="font-size:8.5pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Jeffrey Williams </div><div dir="ltr">Identity & Access Engineer<br>Identity & Access Services<br><a href="https://its.uncg.edu" target="_blank">https://its.uncg.edu</a></div></div><div dir="ltr"><br></div><div dir="ltr"><img src="https://uncgcdn.blob.core.windows.net/email/UNCGLogo.png"><br></div></div></div></div></div></div></div></div></div>