<div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, May 13, 2022 at 1:19 PM Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> wrot<br></div><div>Thanks Nate,</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
No.  Shibboleth only loads certificates from provider metadata.<br></blockquote><div><br></div><div>Ok, at least I guessed the right path :) <br></div><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> Second obstacle: NameIDFormat only unspecified (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified), since in the past I had the same issue with the metadata provided to me at the time (with Google as SP) i fixed in the same way, could be a source of problems?<br>
<br>
It could, depending on application design.  Instead of changing the metadata to match your needs, it'd be best to configure your IdP to release the appropriate attribute as an unspecified NameID.<br></blockquote><div><br></div><div>I tried but I suppose I forgot something:</div><div>I restored the original NameID in the metadata and then in attribute-resolver.xml I put:</div><div>    <AttributeDefinition xsi:type="Simple" id="oneTrustNameID"><br>        <InputDataConnector ref="esLDAP" attributeNames="mail" /><br>        <AttributeEncoder xsi:type="SAML2String" name="ONE-TRUST-PRINCIPAL" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br>    </AttributeDefinition></div><div><br></div><div>in attribute-filter.xml I put:</div><div>    <AttributeFilterPolicy id="OneTrust"><br>        <PolicyRequirementRule xsi:type="Requester" value="<a href="https://app-de.onetrust.com/saml2">https://app-de.onetrust.com/saml2</a>" /><br>        <AttributeRule attributeID="oneTrustNameID"><br>            <PermitValueRule xsi:type="ANY" /><br>        </AttributeRule></div><div><br></div><div>in relying-party.xml I put:<br></div><div></div><div>        <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://app-de.onetrust.com/saml2">https://app-de.onetrust.com/saml2</a>"><br>            <property name="profileConfigurations"><br>                <list><br>                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br>                </list><br>            </property><br>        </bean></div><div><br></div><div>and in saml-nameid.xml I put:<br></div><div> <util:list id="shibboleth.SAML2NameIDGenerators"><br>        <ref bean="shibboleth.SAML2TransientGenerator" /><br></div><div>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br>            p:attributeSourceIds="#{ {'oneTrustNameID'} }"><br>            <property name="activationCondition"><br>                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://app-de.onetrust.com/saml2">https://app-de.onetrust.com/saml2</a>" /><br>            </property><br>        </bean><br><br></div><div>but I get this in the log: " Ignoring NameIDFormat metadata that includes the 'unspecified' format"</div><div></div><div>2022-05-13 16:07:33,927 - 10.xx.xx.15 - INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action FinalizeAuthentication: Principal testuser authenticated<br>2022-05-13 16:07:34,460 - 10.xx.xx.15 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:73] - Ignoring NameIDFormat metadata that includes the 'unspecified' format<br>2022-05-13 16:07:34,905 - 10.xx.xx.15 - WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:94] - Relay state exceeds 80 bytes: ZW1haWw6cy5icmlkaUBlbmdpbnNvZnQuY29tJm9yaWdpbkhvc3Q6ZW5naW5zb2Z0Lm15Lm9uZXRydXN0LmNvbQ==</div><div><br></div><div>Could someone point me to what I am missing?</div><div><br></div><div>Thanks<br></div><div>Stefano<br></div><div><br></div></div></div>