The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

I have forwarded this to the admnistrators of the eduroam SP proxy.

Stefan

Am 08.11.18 um 10:58 schrieb Francesco Malvezzi:
> hi all,
> 
> I have a problem accessing the admin portal of cat.eduroam.org.
> 
> The other day, I have stripped away from local Shibboleth IdP
> eduPersonTargetedID because I thought it was replaced by saml2
> persistent-id, so now ePTID is not released.
> 
> This is the error I receive:
> 
> SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
> 
> Backtrace:
> 1 www/_include.php:45 (SimpleSAML_exception_handler)
> 0 [builtin] (N/A)
> Caused by: sspmod_saml_Error: Responder: SimpleSAML_Error_Exception:
> This service needs at least one of the following
>               attributes to identity users: eduPersonTargetedID, 
> pairwise-id,
> subject-id, facebook_targetedID, google_eppn, linkedin_targetedID,
> twitter_targetedID. Unfortunately not
>               one of them was detected. Please ask your institution 
> administrator to
> release one of
>               them, or try using another identity provider.
> Backtrace:
> 3 modules/saml/lib/Message.php:420 (sspmod_saml_Message::getResponseError)
> 2 modules/saml/lib/Message.php:554 (sspmod_saml_Message::processResponse)
> 1 modules/saml/www/sp/saml2-acs.php:129 (require)
> 0 www/module.php:135 (N/A)
> 
> This is my SAML2 assertion:
> 
> <?xml version="1.0" encoding="UTF-8"?>
> <saml2:Assertion ID="_8c65259efb298655a71e47a39daecc8b"
>     IssueInstant="2018-11-08T09:44:20.184Z" Version="2.0"
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
>     <saml2:Issuer>https://idp.unimore.it/idp/shibboleth</saml2:Issuer>
>     <saml2:Subject>
>         <saml2:NameID
>             Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>             NameQualifier="https://idp.unimore.it/idp/shibboleth";
> SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp";>j8y/HpQRUQOXjLNuvEbX7a3Ldw8=</saml2:NameID>
>     </saml2:Subject>
>     <saml2:AttributeStatement>
>         <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
>             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">address@concealed</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="displayName"
>             Name="urn:oid:2.16.840.1.113730.3.1.241"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">Francesco MALVEZZI</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="schacHomeOrganization"
>             Name="urn:oid:1.3.6.1.4.1.25178.1.2.9"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">unimore.it</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="eduPersonPrincipalName"
>             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue>address@concealed</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="mail"
>             Name="urn:oid:0.9.2342.19200300.100.1.3"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> 
> <saml2:AttributeValue>address@concealed</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="ou" Name="urn:oid:2.5.4.11"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">Dipendenti</saml2:AttributeValue>
>             <saml2:AttributeValue
>                 xmlns:xsd="http://www.w3.org/2001/XMLSchema";
>                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xsd:string">people</saml2:AttributeValue>
>         </saml2:Attribute>
>     </saml2:AttributeStatement>
> </saml2:Assertion>
> 
> I'm going to re-enable ePITD so nothing here is urgent, but is it
> expected a plain persistent-id can't do its job?
> 
> thank you,
> 
> Francesco Malvezzi
> 


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature