How do I send Subject->NameID in "clear" text

[Nate Klingenstein]

Jason,

You should find this configuration option in relying-party.xml.  In  
particular, you're likely using the SAML 2.0 Web Browser SSO Profile  
to communicate with this SP, so the relevant profile in relying- 
party.xml is:

         <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                               includeAttributeStatement="true"
                               assertionLifetime="PT5M"
                               assertionProxyCount="0"
                               signResponses="never"
                               signAssertions="always"
                               encryptAssertions="conditional"
                               encryptNameIds="never" />

I think the default for the IdP is and has been to not encrypt  
NameID's, but rather to encrypt assertions.  Is something indicating  
to you that your IdP is encrypting the NameID?  With recent versions  
of the IdP, you can see the assertion as it's going out by uncommenting:

     <!-- Logs inbound and outbound protocols messages at DEBUG level  
-->
     <logger name="PROTOCOL_MESSAGE" level="DEBUG" />

in logging.xml.

You can configure this profile on a relying party basis if you are in  
fact encrypting NameID's for some reason and want to preserve that  
functionality.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty

Take care,
Nate.

On Dec 23, 2011, at 21:53 , Jason Holland wrote:

> I am trying to get my Shib IdP to work with an SP that requires a  
> phone
> number instead of the username used to authenticate. I think I have it
> setup to send the phone number instead of the username because I can  
> see
> the debug logs are saying that Shib is using the phone for the NameID.
>
> The SP has an example response where the NameID is in clear, human
> readable text so my question is what setting do I change to make it to
> where Shib sends the NameId as "clear" text in the response. I can't
> find any documentation on this. Any hints?
>
> Thanks,
> Jason