<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Philippe,<div><br></div><div>You can send the logs via attachment directly to me if you like. Just raise the main IdP log level to DEBUG and send me the excerpt of one failed transaction. I don’t need to see everything.</div><div><br></div><div>I’ll post the resolution on-list.</div><div><br></div><div>Cheers,</div><div>Nate</div><div><div><br><blockquote type="cite"><div>On Feb 8, 2024, at 6:22 AM, izoret@cines.fr wrote:</div><br class="Apple-interchange-newline"><div><div><div id="zimbraEditorContainer" style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class="3"><div><br></div><div> <!--StartFragment--><div>Hello Nate, <br></div><br><br><div><br>In the attribute-resolver.xml the definition for mail attribute is uncommented. </div><div>=><br></div><div> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <Template><br> <![CDATA[<br> ${uid}@%{idp.scope}<br> ]]><br> </Template><br> </AttributeDefinition></div><br><div>Now, on the <em>saml-nameid.xml</em> , i define an encoder for unspecified attribute request by SP.<br></div><div>=><br></div><div><util:list id="shibboleth.SAML2NameIDGenerators"><br> <ref bean="shibboleth.SAML2TransientGenerator" /><br> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --><br> <!--<br> <ref bean="shibboleth.SAML2PersistentGenerator" /><br> --><br> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br> p:omitQualifiers="true"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br> p:attributeSourceIds="#{ {'mail'} }" /><br> <!--<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br> --><br> </util:list><br><br> <!-- SAML 1 NameIdentifier Generation --><br><util:list id="shibboleth.SAML1NameIdentifierGenerators"><br> <ref bean="shibboleth.SAML1TransientGenerator" /><br> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"<br> p:omitQualifiers="true"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br> p:attributeSourceIds="#{ {'mail'} }" /><br> </util:list><br></div><br><div>After restart tomcat, always the same problem : priori, Idp send the attribute but not as Sp want to receive .. (sorry for my english .)<br></div><br><div>=> lockself_errors : 2: "'mail' variable is required ...<br></div><div><div><pre>----------------
attributes_sent_by_idp
urn:oid:2.5.4.4
0: "izoret"
urn:oid:2.5.4.42
0 "philippe"
urn:oid:1.3.6.1.1.1.1.1:
0 "25501"
upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w=="
lockself_errors
0: "'firstname' variable is required"
1: "'lastname' variable is required"
2: "'mail' variable is required. Can be skip if 'upn' is sent"
3: "'groups' variable is missing. Maybe you doesn't want to use it" </pre></div><div>-----------<br></div></div><br><div>My LOG conf :<br> <variable name="idp.loglevel.idp" value="${idp.loglevel.idp:-DEBUG}" /><br></div><div> <variable name="idp.loglevel.ldap" value="${idp.loglevel.ldap:-WARN}" /><br> <variable name="idp.loglevel.messages" value="${idp.loglevel.messages:-DEBUG}" /><br> <variable name="idp.loglevel.encryption" value="${idp.loglevel.encryption:-INFO}" /><br> <variable name="idp.loglevel.opensaml" value="${idp.loglevel.opensaml:-DEBUG}" /><br> <variable name="idp.loglevel.props" value="${idp.loglevel.props:-INFO}" /><br> <variable name="idp.loglevel.httpclient" value="${idp.loglevel.httpclient:-INFO}" /><br></div><br><div>The Log on DEBUG mode : (it's Huge ..) and it refuse by moderator on a precedent mail ..<br></div><div><br></div><!--EndFragment--> </div><div>Can send the log via attachment ?<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Regards, <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Philippe <br data-mce-bogus="1"></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Nate Klingenstein" <ndk@sudonym.me><br><b>À: </b>"Shib Users" <users@shibboleth.net><br><b>Envoyé: </b>Mercredi 7 Février 2024 16:42:23<br><b>Objet: </b>Re: Ignoring NameIDFormat metadata that includes the 'unspecified' format<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div>Thanks for your reply,</div></div></div></div></blockquote><span style=""><div><span style=""><br></span></div>Of course!</span><br id="lineBreakAtBeginningOfMessage" style=""><br><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div>For one field ("mail") , i'v relase/comment the call on my attribute-resolver.xml (it's the right thing ?)<br></div><div>so for the moment i want test with only mail ..<br></div></div></div></div></blockquote><br><div>I assume this is uncommented in your actual resolver, or it would certainly be your problem.</div><br><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div><!--<br></div><div> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <Template><br> <![CDATA[<br> ${uid}@%{idp.scope}<br> ]]><br> </Template><br> </AttributeDefinition><br>--></div><div>--<br></div><br><div>And add this 2 beans at the end of <em>saml-nameid.xml</em></div></div></div></div></blockquote><br><br><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div><!-- SAML 2 NameID Generation --><br> <util:list id="shibboleth.SAML2NameIDGenerators"><br> <ref bean="shibboleth.SAML2TransientGenerator" /><br> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --><br> <!-- <ref bean="shibboleth.SAML2PersistentGenerator" /> --><br> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br> p:omitQualifiers="true"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br> p:attributeSourceIds="#{ {'mail'} }" /><br> </util:list><br><br> <!-- SAML 1 NameIdentifier Generation --><br> <util:list id="shibboleth.SAML1NameIdentifierGenerators"><br> <ref bean="shibboleth.SAML1TransientGenerator" /><br> <bean parent="shibboleth.SAML1AttributeSourcedGenerator"<br> p:omitQualifiers="true"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br> p:attributeSourceIds="#{ {'mail'} }" /><br> </util:list></div></div></div></div></blockquote><br><div>These are fine, but they don’t define an encoder for unspecified. The end of the format strings is emailAddress instead. If your application is requesting unspecified, you’ll want to fix that.</div><br><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div><span style="font-size:12pt">after uncomment this on saml-nameid.properties :</span></div><div><div>idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div><br> </div><div>If on <em>saml-nameid.xml</em> </div><div> i uncomment the ref bean : <ref bean="shibboleth.SAML2PersistentGenerator" /> </div><br><br><div>2024-02-07 15:58:52,810 - - WARN [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:591] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2NameIDGenerators': Cannot resolve reference to bean 'shibboleth.SAML2PersistentGenerator' while setting bean property 'sourceList' with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Cannot resolve reference to bean '#{'shibboleth.ComputedPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdStore'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.ComputedPersistentIdGenerator' defined in class path resource [net/shibboleth/idp/conf/saml-nameid-system.xml]: Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Global salt and salt lookup strategy cannot both be null<br></div></div></div></div></blockquote><br><div>You’ll need to set up a salt before you can use persistent ID’s, but that’s orthogonal to the apparent issue. The other errors are derived from this one, but again, not directly relevant. I would ignore persistent ID’s for now.</div><br><blockquote><div><div><div><div><font size="3" face="arial, helvetica, sans-serif">upn_sent_by_idp : "AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w==“ </font></div></div></div></div></blockquote><blockquote><div><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt"><div><pre><span style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt">Wich logs can i give you .. Sp Logs ? IDP Logs ?</span></pre></div></div></div></div></blockquote><br><div>We need the IdP’s logs on DEBUG. It will explain exactly why it is unable or unwilling to generate an unspecified NameID.</div><br></div>Best regards,<div>Nate</div><br>-- <br>For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></div></div>-- <br>For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></blockquote></div><br></div></body></html>