The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Francesco Malvezzi <address@concealed>]

hi all,

I have a problem accessing the admin portal of cat.eduroam.org.

The other day, I have stripped away from local Shibboleth IdP
eduPersonTargetedID because I thought it was replaced by saml2
persistent-id, so now ePTID is not released.

This is the error I receive:

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION

Backtrace:
1 www/_include.php:45 (SimpleSAML_exception_handler)
0 [builtin] (N/A)
Caused by: sspmod_saml_Error: Responder: SimpleSAML_Error_Exception:
This service needs at least one of the following
                attributes to identity users: eduPersonTargetedID, 
pairwise-id,
subject-id, facebook_targetedID, google_eppn, linkedin_targetedID,
twitter_targetedID. Unfortunately not
                one of them was detected. Please ask your institution 
administrator to
release one of
                them, or try using another identity provider.
Backtrace:
3 modules/saml/lib/Message.php:420 (sspmod_saml_Message::getResponseError)
2 modules/saml/lib/Message.php:554 (sspmod_saml_Message::processResponse)
1 modules/saml/www/sp/saml2-acs.php:129 (require)
0 www/module.php:135 (N/A)

This is my SAML2 assertion:

<?xml version="1.0" encoding="UTF-8"?>
<saml2:Assertion ID="_8c65259efb298655a71e47a39daecc8b"
    IssueInstant="2018-11-08T09:44:20.184Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:Issuer>https://idp.unimore.it/idp/shibboleth</saml2:Issuer>
    <saml2:Subject>
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            NameQualifier="https://idp.unimore.it/idp/shibboleth";
SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp";>j8y/HpQRUQOXjLNuvEbX7a3Ldw8=</saml2:NameID>
    </saml2:Subject>
    <saml2:AttributeStatement>
        <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
            Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="displayName"
            Name="urn:oid:2.16.840.1.113730.3.1.241"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">Francesco MALVEZZI</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="schacHomeOrganization"
            Name="urn:oid:1.3.6.1.4.1.25178.1.2.9"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">unimore.it</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="eduPersonPrincipalName"
            Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>address@concealed</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="mail"
            Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<saml2:AttributeValue>address@concealed</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="ou" Name="urn:oid:2.5.4.11"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">Dipendenti</saml2:AttributeValue>
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema";
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:type="xsd:string">people</saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>
</saml2:Assertion>

I'm going to re-enable ePITD so nothing here is urgent, but is it
expected a plain persistent-id can't do its job?

thank you,

Francesco Malvezzi
-- 
servizio gestione identità
Università di Modena e Reggio Emilia