<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br><div>Hi !<br></div><br><div>I have to deploy an IDP shibboleth 4.3.1 wich confirm the authentification from an internal vendor Sp (lockself) to our internal OpenLdap.<br></div></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">my IDP work, but on the process Log i've this :<br></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">...<br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">192.168.2.21 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential Validator ldap: Login by 'izoret' succeeded<br>2024-02-07 09:56:03,768 - 192.168.2.21 - INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action FinalizeAuthentication: Principal izoret authenticated<br>2024-02-07 09:56:03,810 - 192.168.2.21 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:73] - Ignoring NameIDFormat metadata that includes the 'unspecified' format<br>2024-02-07 09:56:03,942 - 192.168.2.21 - INFO [Shibboleth-Audit.SSO:338] - 192.168.2.21|2024-02-07T08:55:54.285864Z|2024-02-07T08:56:03.942227Z|izoret|https://multipass-preprod.cines.fr/saml2/metadata|_694228b2d6f1723031630733013f23da|password</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">2024-02-07T08:56:03.765241Z|firstname,mail,Groups,lastname|AAdzZWNyZXQxuLy+bP7HP/+5R8j4vX/NO+BgvgWxnY7N9wRCUkc4Wmz8Xphquf3h6VeL2FYBk5tX5eQF+IZMgLl/xDiyjxFsIuS1bV9qSh8MY6CCskEaakBA3KUYHlYtDKnZimNxPy77ntU8KOrc3q0X5dZvCjAaSu86RDqmLA==|transient|false|true|AES128-GCM|Redirect|POST||Success||8550dcb21a9042fb2d2849e9ce48d99620065ad95c8e1d1ce3dad382cb303e24|Mozilla/5.0 (X11; Linux x86_64; rv:1<br>...</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment--><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;"><br></div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;">As specified here,</div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;"><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration" data-mce-href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration</a><br data-mce-bogus="1"></div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;"><br></div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;">=> Dealing with "Unspecified"</div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;"><br></div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;">i'v try to understand the RelyngPartyConfiguration and MetadataDrivenConfiguration, without success ..</div><div style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: 'arial' , 'helvetica' , sans-serif; font-size: 12pt; color: #000000;"><br></div><!--EndFragment--> </div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">On the SP , the test page give me this :</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">----------------<br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">attributes_sent_by_idp</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment-->urn:oid:0.9.2342.19200300.100.1.3<!--EndFragment--> </div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment-->0: "izoret@cines.fr"<!--EndFragment--> <br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment-->urn:oid:2.5.4.4<!--EndFragment--> <br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment-->0: "izoret"<!--EndFragment--> <br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> </div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> urn:oid:2.5.4.42</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 0 "philippe"</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> urn:oid:1.3.6.1.1.1.1.1:</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 0 "25501"</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> upn_sent_by_idp"AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w=="</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">lockself_errors</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 0: "'firstname' variable is required"</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 1: "'lastname' variable is required"</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 2: "'mail' variable is required. Can be skip if 'upn' is sent"</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> 3: "'groups' variable is missing. Maybe you doesn't want to use it"<br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"> <!--StartFragment-->----------------<!--EndFragment--> </div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">IDP seems doing the job, but not the SP. <br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">My "attribute-resolver.xml" <br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><?xml version="1.0" encoding="UTF-8"?><br><br><AttributeResolver<br> xmlns="urn:mace:shibboleth:2.0:resolver" <br> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <br> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><AttributeDefinition id="uid" xsi:type="PrincipalName" /><br><br><br> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <Template><br> <![CDATA[<br> ${uid}@%{idp.scope}<br> ]]><br> </Template><br> </AttributeDefinition><br><br><AttributeDefinition id="firstname" xsi:type="Simple"><br> <InputDataConnector ref="myLDAP" attributeNames="givenName"/><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" /><br></AttributeDefinition><br><br><AttributeDefinition id="lastname" xsi:type="Simple"><br> <InputDataConnector ref="myLDAP" attributeNames="sn"/><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" /><br></AttributeDefinition><br><br><AttributeDefinition id="Groups" xsi:type="Simple"><br> <InputDataConnector ref="myLDAP" attributeNames="gidNumber"/><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.1.1.1.1" friendlyName="gidNumber" encodeType="false" /><br></AttributeDefinition><br><br><br><DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br></DataConnector><br><br></AttributeResolver><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><br data-mce-bogus="1"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><!--StartFragment-->Could you help me on this topics, with exemple .. ?</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br data-mce-bogus="1"></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">Best Regards,<br><br><div><br>Philippe Izoret<br><br>Centre Informatique de l'Enseignement Supérieur<br>Département des Services Informatiques<br>950 rue de Saint Priest<br>34097 Montpellier cedex 5</div></div><br></div></div></body></html>