<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
So I set those properties:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
idp.c14n.attribute.attributeSourceIds = azureName
<div>idp.c14n.attribute.resolveFromSubject = true<br>
</div>
idp.c14n.attribute.resolutionCondition = shibboleth.Conditions.FALSE<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Created attribute id in registry:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
opt/shibboleth-idp/conf/attributes/custom/azureName.properties:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
<div>id = azureName</div>
<div>transcoder = SAML2StringTranscoder</div>
<div>saml2.name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</div>
saml2.nameFormat = urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
attribute-sourced-subject-c14n-config.xml:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<util:list id="shibboleth.c14n.attribute.AttributesToResolve">
<div> <value>azureName</value></div>
<div> </util:list></div>
<div> <util:list id="shibboleth.c14n.attribute.AttributeSourceIds"></div>
<div> <value>azureName</value></div>
</util:list><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
subject-c14n.xml:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
2022-08-31 09:20:07,117 - INFO [Shibboleth-Audit.SSO:283] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - 2022-08-31T14:20:07.117452Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_32524f8f6facdadbf9a62e21e07186c8|https://sts.windows.net/e202cd47-7a56-4baa-99e3-e3b71a7c77dd/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibboleth.uic.edu/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_aa03a8db-7e80-4226-948e-d62c0991e1b7||urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|azureName|rullfig@uic.edu|_319ea856-c905-46b4-8402-d72fdc4b2600|
<div>2022-08-31 09:20:07,118 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/attribute
for applicability...</div>
<div>2022-08-31 09:20:07,118 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute</div>
<div>2022-08-31 09:20:07,120 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:247] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution with label:
c14n/attribute</div>
<div>2022-08-31 09:20:07,120 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:276] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the following attribute
definitions [azureName]</div>
<div>2022-08-31 09:20:07,120 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:348] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver': No attribute definition was registered with
ID 'azureName', nothing to do</div>
<div>2022-08-31 09:20:07,120 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:282] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver': Finalizing resolved attributes</div>
<div>2022-08-31 09:20:07,120 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:285] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Attribute Resolver 'ShibbolethAttributeResolver': Final resolved attribute collection: []</div>
2022-08-31 09:20:07,121 - WARN [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:183] - [E4849E9BA61354861C90ABC86E2AEBF8] - [128.248.2.59] - Profile Action AttributeSourcedSubjectCanonicalization: No attributes found, canonicalization
not possible<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
"No attribute definition was registered with ID 'azureName'" - where did I go wrong?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, August 30, 2022 4:04 PM<br>
<b>To:</b> Wessel, Keith W (UIUC) <kwessel@illinois.edu>; Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Subject:</b> Re: Azure AD Connector from IDP v4.1 - canonicalization failure</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 8/30/22, 4:51 PM, "Wessel, Keith" <kwessel@illinois.edu> wrote:<br>
<br>
> That’s not literally referring to the subject of the assertion.<br>
<br>
Took me a second to find that text but I clarified it. Java Subject, not SAML Subject, obvious source of confusion in this context.<br>
<br>
4.0 -> run the resolver, do extra stuff there to copy an IdPAttribute from the Subject using some very confusing settings because authentication isn't actually done yet<br>
<br>
4.1+ -> look directly at Subject produced by SAML login flow and find an IdPAttributePrincipal inside it<br>
<br>
Much simpler. Both are "attribute sourced", just no longer both "resolver sourced".<br>
<br>
-- Scott<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>