PrincipalName as NameID?

[Byte Flinger]

Hi

I am trying to set my nameID as my principalName however I am having very
litle succes with it. My principalName is set with the ldapLoginModule and
it is just the username (A string)

If I understand correct TransientId and PersistentId require a mail like
format and because I am getting something that is just any string, I want
to get in unspecified format.

What I have done so far:

- Made sure that only
"<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDForma>"
is found in my idp-metadata.xml (I commented away the others)
- Made sure to add only unspecified nameID (As above) to my sp-metadata.xml
- Commented away the original attribute called transientId which contains 2
attribute encoders of transient format in attribute-resolver.xml
- Added the following attribute to attribute-resolver.xml
   <resolver:AttributeDefinition xsi:type="ad:PrincipalName" id="pNameID" >
                <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
        </resolver:AttributeDefinition>

- Commented away the attributeFilterPolicy
called "releaseTransientIdToAnyone" in attribute-filter.xml
- Added the following attributeFilterPolicy to attribute-filter.xml
   <afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="https://myhost.com/"/>

        <afp:AttributeRule attributeID="pNameID">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>


It feels to me that this should be enough, yet in debug logs I keept seeing
the following message:

No attribute of principal 'someString' can be encoded in to a
NameIdentifier of required format
'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party '
https://myhost.com/'


I don't understand why it keeps saying that it wants a transient format
(Which I believe is what is stopping it from adding to nameId due to no
mail format).

Any help is appreciated, am I doing something wrong?

I based my actions on the following page
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeExamples
with
the small change that I am using a principalName attributeDefinition type
instead of Simple.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130625/576f8db5/attachment.html