<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">My problem is resolved. Here's an update, in case anyone runs across this thread in the future.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">We ended up having an SP that broke. They do not request a persistent subject nameID in their metadata, but their requested attribute list includes ePTID and no other identifier. We've never released ePTID, and they fell back to the subject nameID. At some point in the distant past our config was changed to send the persistent subject nameID in preference to the transient nameID, so logins worked. Then they broke when we started generating different values.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">The underlying problem was something that didn't jump out to me the first several times I looked at it. Our old saml-nameid.properties contained:</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763"><br></div><div class="gmail_default" style=""><blockquote style="color:rgb(7,55,99);font-family:"trebuchet ms",sans-serif;font-size:small;margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">idp.persistentId.salt = “this value has been redacted”<br></div></blockquote><font color="#073763" face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font color="#073763" face="trebuchet ms, sans-serif">The new one had the quotes stripped, a mistake in the way I set up the Ansible playbooks:</font></div><div class="gmail_default" style=""><font color="#073763" face="trebuchet ms, sans-serif"><br></font></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif" color="#073763">idp.persistentId.salt = this value has been redacted</font></div></blockquote><font color="#073763" face="trebuchet ms, sans-serif"><div><br></div><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">-Les</div></div></font><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><br><table style="color:rgb(136,136,136);border:none;border-collapse:collapse"><tbody><tr style="height:0pt;border-top:1pt solid rgb(204,204,204)"><td style="border-right:1pt solid rgb(204,204,204);vertical-align:middle;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><a href="http://www.carleton.edu/" target="_blank"><span style="font-size:11pt;font-family:Arial;color:rgb(17,85,204);vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:70px;height:73px"><img height="73" src="https://lh6.googleusercontent.com/QEL1To3Ci_dJA1huaKzfZ0Lf4MaZlAy_f-W3vQjbyzNq_yXq_ZYGv3tuT4dkaZS_bZ5X6fZR4iKzBboZhxbCF5htZFnLNKGqmrzHsVJtsjsy0pfK5w2z0Dlq-EtZcWhv0PxBpWmR" width="70" style="margin-left:0px;margin-top:0px"></span></span></a></p></td><td style="border-left:1pt solid rgb(204,204,204);vertical-align:top;padding:10.8pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font color="#dea410" face="Arial"><span style="font-size:14.6667px;white-space:pre-wrap"><b>Les LaCroix '79</b></span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Strategic Technologist</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Information Technology Services</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">t: (507) 222-5455</span></span></p></td></tr></tbody></table></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 22, 2021 at 2:01 PM Les LaCroix <<a href="mailto:llacroix@carleton.edu">llacroix@carleton.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">Scott and Peter, thank you for your responses. You confirmed that it wasn't an obvious mistake that I missed. Thanks!</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">I'm going to go down a different path, namely one of not caring. Since late August, my users have logged in to 5 SPs that specifically request a persistent nameid. Of the five, two have a special nameid generator because they demand that the nameid is actually an email address or eppn. Two others I know for sure that they look at attributes and not the subject. I'm willing to bet that the final one also doesn't care about the nameid in the subject, since its metadata lists eppn, epuid, and eptid among the requested attributes.</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">-Les</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">p.s. I determined that my problem wasn't introduced when I tried to upgrade to v4, but sometime before then. I still don't know what I did to create the problem: the relevant properties are the same, and as far as I can tell, we've never made changes to the c14n configs. idp.persistentId.generator has always been commented out in saml-nameid.properties. But I don't think I care.</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)"><br></div><div><div dir="ltr"><div dir="ltr"><br><table style="color:rgb(136,136,136);border:none;border-collapse:collapse"><tbody><tr style="height:0pt;border-top:1pt solid rgb(204,204,204)"><td style="border-right:1pt solid rgb(204,204,204);vertical-align:middle;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><a href="http://www.carleton.edu/" target="_blank"><span style="font-size:11pt;font-family:Arial;color:rgb(17,85,204);vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:70px;height:73px"><img height="73" src="https://lh6.googleusercontent.com/QEL1To3Ci_dJA1huaKzfZ0Lf4MaZlAy_f-W3vQjbyzNq_yXq_ZYGv3tuT4dkaZS_bZ5X6fZR4iKzBboZhxbCF5htZFnLNKGqmrzHsVJtsjsy0pfK5w2z0Dlq-EtZcWhv0PxBpWmR" width="70" style="margin-left: 0px; margin-top: 0px;"></span></span></a></p></td><td style="border-left:1pt solid rgb(204,204,204);vertical-align:top;padding:10.8pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font color="#dea410" face="Arial"><span style="font-size:14.6667px;white-space:pre-wrap"><b>Les LaCroix '79</b></span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Strategic Technologist</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Information Technology Services</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">t: (507) 222-5455</span></span></p></td></tr></tbody></table></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 22, 2021 at 7:26 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Basically that's all impossible, so that leaves "something you think is the same isn't", and there's not really any way to debug that but you.<br>
<br>
The inputs to the calculation are obviously the principal, salt, and SP entityID, and then the digest and encoding. One of them's not the same, that's really all there is to it.<br>
<br>
I would maybe be looking at principal name and perhaps see if subject c14n is not doing what it was doing originally.<br>
<br>
-- Scott<br>
<br>
<br>
</blockquote></div>
</blockquote></div>