NameID element must be present as part of the Subj

Question

Hey I am trying to configure IDP with my service provider but when saml response comes from IDP I got this error in my service provider

org.opensaml.common.SAMLException: NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse

I configured NameId in idp - metadata xml

   <NameID>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameID>
            <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
                <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

here is the whole response


<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost:8082/saml/SSO" ID="_9129c7121ce71d24e32d5dfe527bd760" InResponseTo="a1eei99dgc9442d72a98h62i9d179j9" IssueInstant="2016-05-31T15:52:04.736Z" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">idp.test.com/idp/shibboleth</saml2:Issuer>
   <saml2p:Status>
      <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </saml2p:Status>
   <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_4fcade81e4aae59bfa099e692158a687" Type="http://www.w3.org/2001/04/xmlenc#Element">
         <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
         <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <xenc:EncryptedKey Id="_bd99cfd23b6342cf0b4adf7fa03d203f" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
               <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                  <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
               </xenc:EncryptionMethod>
               <ds:KeyInfo>
                  <ds:X509Data>
                     <ds:X509Certificate></ds:X509Certificate>
                  </ds:X509Data>
               </ds:KeyInfo>
               <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                  <xenc:CipherValue>ssss</xenc:CipherValue>
               </xenc:CipherData>
            </xenc:EncryptedKey>
         </ds:KeyInfo>
         <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <xenc:CipherValue>!!!</xenc:CipherValue>
         </xenc:CipherData>
      </xenc:EncryptedData>
   </saml2:EncryptedAssertion>
</saml2p:Response>

I don' understand what is nameID and how to configure it I will appreciate your help tnx

Answer 1

In the SAML world there are two ways of return the user's identity to the SP. The Subject area or the Attribute Statement area. Many newer SP configurations use an attribute in the attribute statement, but the subject area should still be populated. If the SP is using an attribute to get the user's identity, then configure Shibboleth to return the transientId to the SP in question. Otherwise, you'll need to refer to the SP docs/config or metadata to determine which NameID Formats are supported by the SP and configure Shibboleth to return the appropriate value with the appropriate format.

A good follow-up read is a shib-user's thread: http://shibboleth.1660669.n2.nabble.com/No-NameID-released-td7605312.html.