Liferay SAML plugin metadata missing name id format

[Abhi R，修改在9 年前。]

Hi there,

I'm generating SAML metadata file with liferay 6.2 saml plugin to talk to ADFS identity provider. For some reason the metadata file that is generated by my plugin is missing the nameidformat attribute and as a result of that I have issues talking to the ADFS identity provider. Below is my portal-ext.properties. Am I missing something? Is there something I should add to the properties to generate the nameidformat property. I greatly appreciate any kind of help!

saml.enabled=true
saml.role=sp
saml.entity.id=liferaysamlspdemo
saml.metadata.paths=${liferay.home}/data/FederationMetadata.xml
saml.sp.user.attribute.mappings=emailAddress=emailAddress
saml.sp.metadata.name.id.format=urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress
saml.keystore.type=jks
saml.keystore.path=${liferay.home}/data/keystore.jks
saml.keystore.password=liferay
saml.keystore.credential.password[liferaysamlspdemo]=liferay
saml.sp.default.idp.entity.id='http://xxxxxxxxxxxx/adfs/services/trust'
saml.sp.sign.authn.request=true
saml.sp.assertion.signature.required=false
saml.sp.clock.skew=3000
saml.sp.session.keepalive.url=http://localhost:8080/c/portal/saml/idp/keepalive

Many Thanks!

[Abhi R，修改在9 年前。]

Below is the metadata XML that is generated by my Liferay SAML Service Provider. As you can see that there is no nameid format or policy information inside it

I appreciate any help with this!

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor entityID="liferaysamlspdemo"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<dsigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<dsigestValue>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</dsigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIC4TCCAckCBgFH7Eh5KjANBgkqhkiG9w0BAQUFADA0MQ0wCwYDVQQDDAR0ZXN0MQ0wCwYDVQQK
DAR0ZXN0MRQwEgYDVQQGEwtOZXcgWmVhbGFuZDAeFw0xNDA4MTkwMzIxMThaFw0xNTA4MTAwMzIx
MThaMDQxDTALBgNVBAMMBHRlc3QxDTALBgNVBAoMBHRlc3QxFDASBgNVBAYTC05ldyBaZWFsYW5k
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhTlRrHFq7B3JRXq/Li+2A4Uv4qPeS3fN
/HMPAAb6+ngNgxs9fX3wiRwQN8Ks2LJyN5nrd/AECpnJ+SQmWTl8fJtBMZXT/CVfBiT4RpuRrHtu
Nmd61AtWPzZi6UYwQJju2fs3q1EkvwIQbdehZjnU4BxzxE/GkXyMHlGzNGLH2zZbDNiJL4Cxx486
grB1xQ8Fa3VzsVrJZ+0rumfLJZLD/5WXygLNe8yBmDm4RKrjbvdMxNDsjWTqg4Dy3OQiojjboo6p
wvdcO3l4xUjLMVjj20ACRIQ9sfNuMD9zX6CekyiyWRZ3uKWAEML/KucQXA4o8CXO04IfYu+/6R6U
0zOelQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBW7BzxdCzYuLJBXf2Ig5B1u5SANxvLcKHurPMr
Sq2qOrPOKiJntkaXbTvajwFwanyZbktHcsgTpJ9KgVl4onEv+H5K8WS8XRemHgMqfDfLq8/A1PZd
BH+7AzEhu1JVYhwkrzBmye6HWGn2Eu7ymS7ANeHbvNCt2Ai3ZlD5o3LJUzF7JP7hbvZxfkFVQXNG
/av4EgLW3iCrF3NHeVnXS5Z8iT1i19qmRHpWSC8Ydysc+kj7es/l0CcjiGw8yc8YR40PytOiUU
2YBeVGHIDir65wLpfVA57b5voHpo1m91xa4EmcNN2NfOCUTJmcKFAO438ve6OGu4dyaHvqy+a2OR
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<md:SPSSODescriptor AuthnRequestsSigned="false"
ID="liferaysamlspdemo" WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIC4TCCAckCBgFH7Eh5KjANBgkqhkiG9w0BAQUFADA0MQ0wCwYDVQQDDAR0ZXN0MQ0wCwYDVQQK
DAR0ZXN0MRQwEgYDVQQGEwtOZXcgWmVhbGFuZDAeFw0xNDA4MTkwMzIxMThaFw0xNTA4MTAwMzIx
MThaMDQxDTALBgNVBAMMBHRlc3QxDTALBgNVBAoMBHRlc3QxFDASBgNVBAYTC05ldyBaZWFsYW5k
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhTlRrHFq7B3JRXq/Li+2A4Uv4qPeS3fN
/HMPAAb6+ngNgxs9fX3wiRwQN8Ks2LJyN5nrd/AECpnJ+SQmWTl8fJtBMZXT/CVfBiT4RpuRrHtu
Nmd61AtWPzZi6UYwQJju2fs3q1EkvwIQbdehZjnU4BxzxE/GkXyMHlGzNGLH2zZbDNiJL4Cxx486
grB1xQ8Fa3VzsVrJZ+0rumfLJZLD/5WXygLNe8yBmDm4RKrjbvdMxNDsjWTqg4Dy3OQiojjboo6p
wvdcO3l4xUjLMVjj20ACRIQ9sfNuMD9zX6CekyiyWRZ3uKWAEML/KucQXA4o8CXO04IfYu+/6R6U
0zOelQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBW7BzxdCzYuLJBXf2Ig5B1u5SANxvLcKHurPMr
Sq2qOrPOKiJntkaXbTvajwFwanyZbktHcsgTpJ9KgVl4onEv+H5K8WS8XRemHgMqfDfLq8/A1PZd
BH+7AzEhu1JVYhwkrzBmye6HWGn2Eu7ymS7ANeHbvNCt2Ai3ZlD5o3LJUzF7JP7hbvZxfkFVQXNG
/av4EgLW3iCrF3NHeVnXS5Z8iT1i19qmRHpWSC8Ydysc+kj7es/l0CcjiGw8yc8YR40PytOiUU
2YBeVGHIDir65wLpfVA57b5voHpo1m91xa4EmcNN2NfOCUTJmcKFAO438ve6OGu4dyaHvqy+a2OR
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://XXXXXXXXXXXXXX:8443/c/portal/saml/slo_soap" />
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://XXXXXXXXXXXXXX:8443/c/portal/saml/acs"
index="1" isDefault="true" />
</md:SPSSODescriptor>
</md:EntityDescriptor>

[Matthieu Levesque，修改在9 年前。]

I'm at the same point. I tried with Liferay 6.1.20 and a new instance of 6.2 GA8 (both EE) with the same result. Can't seem to find any information as documentation is quite thin...

[Matthieu Levesque，修改在9 年前。]

We finally integrated with CAS piggybacking on top of SAML (AD FS) and Liferay authenticates directly on CAS.