<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
@font-face
{font-family:"Helvetica Neue";
panose-1:2 0 5 3 0 0 0 2 0 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.gmail-p1, li.gmail-p1, div.gmail-p1
{mso-style-name:gmail-p1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.gmail-s1
{mso-style-name:gmail-s1;}
span.gmail-apple-converted-space
{mso-style-name:gmail-apple-converted-space;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent (their sp metadata) is NOT equal to urn:oasis:names:tc:SAML:1.1:nameid-format:persistent (your saml-nameid.xml)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Nadim El-Khoury via users <users@shibboleth.net><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Monday, November 14, 2022 at 3:36 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Nadim El-Khoury <nel-khoury@springfield.edu><br>
<b>Subject: </b>Shibboleth IDP (V4.2.1) and Neod/Neogov setup<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Everyone,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We are trying to set up Single Sign-On between us and Neod/Neogov and it is not working.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We dynamically consume their Metadata through InCommon, and they require that the SAML NameID be persistent and in the email address format.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Their metadata is below.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><md:EntityDescriptor entityID="<a href="https://urldefense.com/v3/__https:/login.neoed.com/__;!!IBzWLUs!S_fGE1Gts4gC_Mk8c6znViv55-734E56cCkBw5RNRfZWgAtpA6Z-svDerlFHANqUW2rm8eYHFHXp_YLR$">https://login.neoed.com/</a>" ID="_697e849a-7a17-43e7-8034-fcae23e2767d"><br>
<md:SPSSODescriptor ID="_8153bed2-27cb-4e3a-b2f1-664a2325f71e" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<md:NameIDFormat><br>
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent<br>
</md:NameIDFormat><br>
<md:NameIDFormat><br>
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
</md:NameIDFormat><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://urldefense.com/v3/__https:/login.neoed.com/authentication/saml/consumer__;!!IBzWLUs!S_fGE1Gts4gC_Mk8c6znViv55-734E56cCkBw5RNRfZWgAtpA6Z-svDerlFHANqUW2rm8eYHFN2sOuZ_$">https://login.neoed.com/authentication/saml/consumer</a>"
index="0" isDefault="true"/><br>
<md:AttributeConsumingService index="1" isDefault="true"><br>
<md:ServiceName xml:lang="en">Neogov SSO</md:ServiceName><br>
<md:RequestedAttribute isRequired="true" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"/><br>
</md:AttributeConsumingService><br>
</md:SPSSODescriptor><br>
</md:EntityDescriptor><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We see the following message in the SAML tracer file and the logs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-family:Menlo;color:black">2022-11-14 15:15:48,830 - 10.2.50.21 - WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier
format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-family:Menlo;color:black">2022-11-14 15:15:48,834 - 10.2.50.21 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We did not know whether we needed to uncomment the following line in saml-nameid.xml or create a SAML2AttributeSourceGnerator that I am including below.<o:p></o:p></p>
</div>
<div>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black"> </span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black"><!--</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black"><ref bean="shibboleth.SAML2PersistentGenerator" /></span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black">--></span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-family:Menlo;color:black"><br>
<br>
<o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-stretch:normal"><span class="gmail-s1"><span style="font-family:Menlo;color:black"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-stretch:normal"><span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black">p:omitQualifiers="true"</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-stretch:normal"><span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black">p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent"</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-stretch:normal"><span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black">p:attributeSourceIds="#{ {'mail'} }"</span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-stretch:normal"><span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black">
</span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black">p:activationCondition-ref="PersistentMailCondition" ></span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-family:Menlo;color:black"> </span></span><span class="gmail-s1"><span style="font-family:Menlo;color:black"></bean></span></span><span style="font-family:Menlo;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Your help or direction is very much appreciated.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Nadim<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:black">"Twenty years from now you will be more disappointed by the things that you didn't do than by the ones you did do. So throw off the bowlines. Sail away from the safe
harbor. Catch the trade winds in your sails. Explore. Dream. Discover." Mark Twain</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>