<div dir="ltr"><div>Hi Peter,</div><div><br></div><div>I made changes to the attribute-resolver.xml (I think) but I also had to remove an additional line, "useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}" from that file, otherwise the IdP was failing to start.</div><div><br></div><div>Here's the current attribute-resolver.xml:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><?xml version="1.0" encoding="UTF-8"?><br><!--<br>This file is a rudimentary example. While it is semi-functional, it isn't very<br>interesting. It is here only as a starting point for your deployment process<br>to avoid any dependency on components like an LDAP directory.<br><br>Very few attribute definitions and data connectors are demonstrated, and the<br>data is derived statically from the logged-in username and a static example<br>connector.<br><br>The file(s) in the examples directory contain more examples that involve more<br>complex approaches. Deployers should refer to the documentation for a complete<br>list of possible components and their options.<br>--><br><AttributeResolver<br> xmlns="urn:mace:shibboleth:2.0:resolver"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver <a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd</a>"><br><br><br> <!-- ========================================== --><br> <!-- Attribute Definitions --><br> <!-- ========================================== --><br><br> <!--<br> The EPPN is the "standard" federated username in higher ed.<br> For guidelines on the implementation of this attribute, refer<br> to the Shibboleth and eduPerson documentation. Above all, do<br> not expose a value for this attribute without considering the<br> long term implications.<br> --><br> <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}"><br> <InputAttributeDefinition ref="uid" /><br> </AttributeDefinition><br><br> <!--<br> The uid is the closest thing to a "standard" LDAP attribute<br> representing a local username, but you should generally *never*<br> expose uid to federated services, as it is rarely globally unique.<br> --><br> <AttributeDefinition id="uid" xsi:type="PrincipalName" /><br><br> <!--<br> In the rest of the world, the email address is the standard identifier,<br> despite the problems with that practice. Consider making the EPPN<br> value the same as your official email addresses whenever possible.<br> --><br> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <Template><br> <![CDATA[<br> ${<a href="mailto:uid%7D@example.org">uid}@example.org</a><br> ]]><br> </Template><br> </AttributeDefinition><br><br> <!--<br> This is an example of an attribute sourced from a data connector.<br> --><br> <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped" scope="%{idp.scope}"><br> <InputDataConnector ref="myLDAP" attributeNames="affiliation" /><br> </AttributeDefinition><br><br><br> <!-- ========================================== --><br> <!-- Data Connectors --><br> <!-- ========================================== --><br><br> <!-- Example LDAP Connector --><br><br> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> startTLSTimeout="%{idp.attribute.resolver.LDAP.startTLSTimeout}"<br> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"<br> connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"<br> noResultIsError="true"<br> multipleResultsIsError="true"<br> excludeResolutionPhases="c14n/attribute"<br> exportAttributes="mail displayName sn givenName departmentNumber employeeNumber eduPersonEntitlement eduPersonAssurance"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br> <ConnectionPool<br> minPoolSize="%{idp.pool.LDAP.minSize:3}"<br> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br> validateDN="%{idp.pool.LDAP.validateDN:}"<br> validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"<br> validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"<br> prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"<br> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/><br> </DataConnector><br><br></AttributeResolver></blockquote><div><br></div><div><br></div><div>However, I am still getting no nameid in the SAMLResponse message when I test :( ....</div><div><br></div><div><br></div><div>I was checking a bunch of other things, and was comparing to some Shibboleth IdP metadata that I found by googling, e.g., UNC's IdP metadata, and I was looking at the metadata from my Shibboleth IdP, and I noticed that there are no "
<span style="color:rgb(136,18,128);font-family:monospace;font-size:13px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none">NameIDFormat</span>" stanzas in the IdP metadata? (There is also no "
<span style="color:rgb(136,18,128);font-family:monospace;font-size:13px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none">ArtifactResolutionService</span>" stanza either). </div><div><br></div><div>FYI, originally/earlier, I ran the Shibboleth IdP install script, and I did not do anything additional to that metadata file after that. </div><div><br></div><div>Was I supposed to manually add the NameIDFormat stanzas to the IdP metadata that got produced by the install script?</div><div><br></div><div>FYI, here is why my Shibboleth IdP metadata looks like currently:</div><div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><!--<br> This is example metadata only. Do *NOT* supply it as is without review,<br>and do *NOT* provide it in real time to your partners.<br>This metadata is not dynamic - it will not change as your configuration changes.<br>On Demand Metadata Generation available from the metadatagen plugin.<br>--><br><md:EntityDescriptor entityID="<a href="https://idp01.xxxx.com/idp/shibboleth">https://idp01.xxxx.com/idp/shibboleth</a>" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br> <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br> <md:Extensions><br> <shibmd:Scope regexp="false"><a href="http://xxxx.com">xxxx.com</a></shibmd:Scope><br> <mdui:UIInfo><br> <mdui:DisplayName xml:lang="en">A name for the IdP at <a href="http://idp01.xxxx.com">idp01.xxxx.com</a></mdui:DisplayName><br> <mdui:Description xml:lang="en">Enter a description for the IdP at <a href="http://idp01.xxxx.com">idp01.xxxx.com</a></mdui:Description><br> <mdui:Logo xml:lang="en" width="80" height="80"><a href="https://idp01.xxxx.com/path/to/logo.png">https://idp01.xxxx.com/path/to/logo.png</a></mdui:Logo><br> </mdui:UIInfo><br> </md:Extensions><br> <md:KeyDescriptor use="signing"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEJzCCAo+gAwIBAgIUFVflFeQ4NpCU3NYG0qQKrw226uAwDQYJKoZIhvcNAQELBQAwGjEYMBYG<br>A1UEAwwPaWRwMDEuamxmb28uY29tMB4XDTI1MDQwNjA2MjUyNVoXDTQ1MDQwNjA2MjUyNVowGjEY<br>.<br>.<br>.<br>9US/kcq8hfIPv+ySvGGmkXMfkNa2LW7ynS8l9l5xmDRDBTUJpfrmUwkZy6sakt6Hijo6I3NZwOdn<br>aO7YiTXMSVcvg+WesGYjxD76XHmeB+yhLGcM0SmP7jzYUF1pTQFgH7Q=<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:KeyDescriptor use="signing"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEJzCCAo+gAwIBAgIUc33YkmOgONgZLiUdIcRsVPItWCUwDQYJKoZIhvcNAQELBQAwGjEYMBYG<br>.<br>.<br>.<br>FUE/+meDluNbZ1nImkA/lxDXS3/OLLkUveiJAcRhWxsNpHChdRtPVtaDqrqJYlsCpQ+WLw0H96tn<br>W67RAmB9Kzs+onJfucXTYeLdTcv7sK8FPvxUWbsJj0bgXidpuhCXFUs=<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:KeyDescriptor use="encryption"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEKDCCApCgAwIBAgIVAND4cmlh4HBvqH5194gzyg5j7NuLMA0GCSqGSIb3DQEBCwUAMBoxGDAW<br>BgNVBAMMD2lkcDAxLmpsZm9vLmNvbTAeFw0yNTA0MDYwNjI1MjFaFw00NTA0MDYwNjI1MjFaMBox<br>.<br>.<br>.<br>UYAGrJ7dhWR0sWXxp/MhThMoJVorZodOCwGl8Pi+fqkqJMsF72m12vuzfEoToCHizliNMfCol9e5<br>Vw6XXsiDumInpvSGy6vQOelecNYdCTVa0lX+3DuOABSQk0iASPMdlo2+<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp01.xxxx.com:34487/idp/profile/SAML2/SOAP/ArtifactResolution">https://idp01.xxxx.com:34487/idp/profile/SAML2/SOAP/ArtifactResolution</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://idp01.xxxx.com:34487/idp/profile/SAML2/POST-SimpleSign/SSO">https://idp01.xxxx.com:34487/idp/profile/SAML2/POST-SimpleSign/SSO</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://idp01.xxxx.com:34487/idp/profile/SAML2/Redirect/SSO">https://idp01.xxxx.com:34487/idp/profile/SAML2/Redirect/SSO</a>" /><br> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://idp01.xxxx.com:34487/idp/profile/SAML2/POST/SSO">https://idp01.xxxx.com:34487/idp/profile/SAML2/POST/SSO</a>" /><br> </md:IDPSSODescriptor><br></md:EntityDescriptor></blockquote><br></div><div><br></div><div>Thanks,</div><div><br></div><div>Jim</div><div><br></div><div><br></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Apr 9, 2025 at 6:14 PM Peter Schober via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">o haya via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> [2025-04-09 23:57 CEST]:<br>
> Were you thinking that I had already copied that Are you saying that<br>
> "conf/examples/attribute-resolver-ldap.xml" file over the original<br>
> "conf/attribute-resolver.xml" file?<br>
<br>
I'd start with LDAP by copying over the DataConnector from the<br>
provided example file, yes. That's what the example files are for.<br>
Then also copy over one of the AttributeDefinitions and adapt that to<br>
match what's in your LDAP DSA.<br>
<br>
> Also, I have a separate question: As mentioned, I am using an OpenDJ<br>
> LDAP.... the login for the LDAP is using "cn=Directory Manager"<br>
<br>
Which is irrelevant at this point as you've configured the<br>
anonSearchAuthenticator. (Or that's default, then you have not yet<br>
configured the bindSearchAuthenticator that would perform a bind<br>
first.)<br>
<br>
> which I<br>
> have set in one of the properties in the ldap.properties file, but I'd been<br>
> wondering where the password for the "cn=Directory Manager" is supposed to<br>
> be set, and I think I just found that is be in the<br>
> /opt/shibboleth-idp/credentials/secrets.properties.<br>
<br>
Yup.<br>
<br>
> That secrets.properties file has:<br>
> <br>
> # Default access to LDAP authn and attribute stores.<br>
> > idp.authn.LDAP.bindDNCredential =myServicePassword<br>
> > idp.attribute.resolver.LDAP.bindDNCredential =%{idp.authn.LDAP.bindDNCredential:undefined}<br>
> <br>
> I am *assuming* that I should put the password for the "cn=Directory<br>
> Manager" as the value for the 2nd line (i.e., replace the<br>
> "myServicePassword" with the password for the "cn=Directory Manager", but I<br>
> kind of unclear what to do to the 3rd line? Should I also replace the<br>
> "undefined" with that same password value?<br>
<br>
Java properties can reference other Java properties (which is why when<br>
you replace "myServicePassword" in the 1st line above it'll also be<br>
set for the 2nd line above).<br>
Furthermore, they can have default/fallback values so that they are<br>
not undefined when no value has been set (2nd line, after the colon).<br>
Ignore that part for now and just set the password for your bind user<br>
in the 1st line.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>