<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Roberto,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The no attributes from pass-through connector is clearly the issue. I assume you’ve added all of the Azure attributes to the IdP’s attribute registry and are mapping one to the c14n subject?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Ullfig, Roberto Alfredo via users<br>
<b>Sent:</b> Tuesday, August 30, 2022 12:24 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Ullfig, Roberto A (UIC) <rullfig@uic.edu><br>
<b>Subject:</b> Azure AD Connector from IDP v4.1 - canonicalization failure<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We've got this all set up as per the document:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using*SAML*Proxying*in*the*Shibboleth*IdP*to*connect*with*Azure*AD__;KysrKysrKysrKys!!DZ3fjg!5z9og4qCRwsjHtLAZaHAMMifM-WNH0VFASiruY439aSQeEMTKnrB5XiSpQDKgWH0WzDLQ60bLW6V58nkjoqy$">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">but aren't able to canonicalize the person identifier. We are doing the hybrid approach for attributes - they are elsewhere. Any clues from this log:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,608 - INFO [Shibboleth-Audit.SSO:283] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - 2022-08-30T17:17:51.608858Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_2b8142d291e2b4fb281f989450f5731e|https://sts.windows.net/e202cd47-7a56-4baa-99e3-e3b71a7c77dd/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibboleth.uic.edu/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_21c1c8a5-214d-42ce-8c3d-603127bd496c||urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||rullfig@uic.edu|_571c4178-d65e-4bd8-823d-2043d4306100|
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,609 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Checking canonicalization flow c14n/attribute for applicability...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,609 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Selecting canonicalization flow c14n/attribute<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,610 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:247] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Initiating attribute resolution with label: c14n/attribute<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:465] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Resolving dependencies for 'passthroughAttributes'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:474] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Finished resolving dependencies for 'passthroughAttributes'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:420] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Resolving data connector passthroughAttributes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.impl.SubjectDataConnector:183] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Data Connector 'passthroughAttributes':
No Subjects returned from SubjectContext lookup, no attributes resolved<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:225] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Data Connector 'passthroughAttributes':
produced the following 0 attributes during resolution []<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:443] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Data connector 'passthroughAttributes' resolved the following attributes: []<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,611 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:276] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Attempting to resolve the following attribute definitions [canonicalNameToUseForJoin]<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,612 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:465] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Resolving dependencies for 'canonicalNameToUseForJoin'<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,612 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:474] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Finished resolving dependencies for 'canonicalNameToUseForJoin'<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,612 - INFO [net.shibboleth.idp.attribute.resolver.ad.impl.ContextDerivedAttributeDefinition:176] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - SubjectDerivedAttributeDefinition
canonicalNameToUseForJoin Generated no values, no attribute resolved <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,612 - DEBUG [net.shibboleth.idp.attribute.resolver.ad.impl.ContextDerivedAttributeDefinition:108] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Definition
'canonicalNameToUseForJoin': Generated no values.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:133] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Definition 'canonicalNameToUseForJoin':
no attribute was produced during resolution<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:259] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Resolver plugin 'canonicalNameToUseForJoin'
produced no value.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:358] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Attribute definition 'canonicalNameToUseForJoin' produced no attribute<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:282] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Finalizing resolved attributes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:531] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Removing result of attribute definition 'canonicalNameToUseForJoin', it is null<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,613 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:285] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver':
Final resolved attribute collection: []<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,614 - WARN [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:183] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action AttributeSourcedSubjectCanonicalization:
No attributes found, canonicalization not possible<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,614 - INFO [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:62] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Moving incomplete flow c14n/attribute to intermediate set, reselecting a different one<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,615 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Checking canonicalization flow c14n/x500 for applicability...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,615 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Canonicalization flow c14n/x500 was not applicable: Neither a single X509Certificate nor X500Principal were found<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,615 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Checking canonicalization flow c14n/simple for applicability...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,615 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
Canonicalization flow c14n/simple was not applicable: No UsernamePrincipals were found<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">2022-08-30 12:17:51,615 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - [AE5CDD926C4A9E6EA13801DE2EE95467] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow:
No potential flows left to choose from, canonicalization will fail<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper">
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">---
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Roberto Ullfig - rullfig@uic.edu<br>
Systems Administrator<br>
Enterprise Applications & Services | Technology Solutions<br>
University of Illinois - Chicago</span><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>