<div dir="ltr"><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><span style="color:rgb(0,0,0);white-space:pre-wrap">Hello everybody,</span><br></div><div dir="ltr"><div><pre style="white-space:pre-wrap;color:rgb(0,0,0)">I'm not able to get our shibboleth idp3 to communicate via SSO
with hubspot.</pre><pre style="white-space:pre-wrap;color:rgb(0,0,0)">I got this error in saml response:
</pre><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"> </span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">saml2p:Status</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">saml2p:StatusCode</span> <span style="color:rgb(221,0,169)">Value</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:2.0:status:Requester"</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">saml2p:StatusCode</span> <span style="color:rgb(221,0,169)">Value</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"</span> /></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"></<span style="color:rgb(0,116,232)">saml2p:StatusCode</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">saml2p:StatusMessage</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">An error occurred.</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"></<span style="color:rgb(0,116,232)">saml2p:StatusMessage</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"></<span style="color:rgb(0,116,232)">saml2p:Status</span>>
</span><br>I use an external authentication with a jsp servlet with hardcode username as "<a href="mailto:test_sso@example.com" target="_blank">test_sso@example.com</a>" as Attribute PRINCIPAL_KEY_NAME.<br><font face="tahoma, sans-serif"><i>try {<br> final String key = ExternalAuthentication.startExternalAuthentication(request);<br> final String username = "</i></font><a href="mailto:test_sso@example.com" target="_blank">test_sso@example.com</a><font face="tahoma, sans-serif"><i>";<br> if (username != null) {<br> request.setAttribute(ExternalAuthentication.PRINCIPAL_NAME_KEY, username);<br> }<br> ExternalAuthentication.finishExternalAuthentication(key, request, response);<br><br>} catch (final ExternalAuthenticationException e) {<br> throw new ServletException("Error processing external authentication request", e);<br>}</i></font></div><div><br>In process.log I got:<br><i><font color="#ff0000">Profile Action ValidateExternalAuthentication: External authentication succeeded for user: <a href="mailto:test_sso@example.com" target="_blank">test_sso@example.com</a><br></font></i>After that I got in process.log:<br>WARN: [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy<br><br>So my SAML request is:<br><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">samlp:AuthnRequest</span> <span style="color:rgb(221,0,169)">xmlns:samlp</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:2.0:protocol"</span>
<span style="color:rgb(221,0,169)">xmlns:saml</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:2.0:assertion"</span>
<span style="color:rgb(221,0,169)">ID</span>=<span style="color:rgb(0,62,170)">"ONELOGIN_7180ee53-397d-415e-ae56-1f38eeb2cmp3"</span>
<span style="color:rgb(221,0,169)">Version</span>=<span style="color:rgb(0,62,170)">"2.0"</span>
<span style="color:rgb(221,0,169)">IssueInstant</span>=<span style="color:rgb(0,62,170)">"2021-06-04T15:10:01Z"</span>
<span style="color:rgb(221,0,169)">Destination</span>=<span style="color:rgb(0,62,170)">"<a href="https://myhostname.com/idp/profile/SAML2/Redirect/SSO" target="_blank">https://myhostname.com/idp/profile/SAML2/Redirect/SSO</a>"</span>
<span style="color:rgb(221,0,169)">ProtocolBinding</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</span>
<span style="color:rgb(221,0,169)">AssertionConsumerServiceURL</span>=<span style="color:rgb(0,62,170)">"<a href="https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId</a>"</span>
></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">saml:Issuer</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><a href="https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId</a></span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"></<span style="color:rgb(0,116,232)">saml:Issuer</span>></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"><<span style="color:rgb(0,116,232)">samlp:NameIDPolicy</span> <span style="color:rgb(221,0,169)">Format</span>=<span style="color:rgb(0,62,170)">"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</span>
<span style="color:rgb(221,0,169)">AllowCreate</span>=<span style="color:rgb(0,62,170)">"true"</span>
/></span><span style="color:rgb(68,68,68);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap">
</span><span style="color:rgb(220,45,37);font-family:Consolas,"Lucida Console",Courier,monospace;font-size:10.6667px;white-space:pre-wrap"></<span style="color:rgb(0,116,232)">samlp:AuthnRequest</span>>
</span><br>My sp metadata is:<br><i><font style="background-color:rgb(255,255,255)" color="#444444"><md:EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" <br> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" <br> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" <br> xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>" <br> entityID="<a href="https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId</a>"><br> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="false"><br> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId</a>"/><br> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId</a>" isDefault="true" index="1"/><br> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId" target="_blank">https://api.hubspot.com/login-api/v1/saml/acs?portalId=myPortalId</a>" isDefault="true" index="2"/><br> </md:SPSSODescriptor><br></md:EntityDescriptor><br></font></i><br></div><div><br></div><div>Note that I didn't change saml-nameid.xml but I changed saml-nameid.properties:<br><i><font color="#ff0000">idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</font></i> <br><br>In process.log I got also:<br>INFO [Shibboleth-Audit.SSO:275] - 20210604T151002Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|ONELOGIN_7180ee53-397d-415e-ae56-1f38eeb2cfd3|<a href="https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://myhostname.com/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_8524eeefff3a8cbee2f6b31f2fda51ce%7Ctest_sso@example.com" target="_blank">https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myhostname.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8524eeefff3a8cbee2f6b31f2fda51ce|test_sso@example.com</a><br><br>Thank you</div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div><br></div></div></div></div></div></div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><br></div></div></div></div></div></div>