PrincipalName as NameID?

[Peter Schober]

Hi "byte filger",

* Byte Flinger <byteflinger at gmail.com> [2013-06-25 17:45]:
> I am trying to set my nameID as my principalName however I am having very
> litle succes with it. My principalName is set with the ldapLoginModule and
> it is just the username (A string)

The over way round, right? ("set my principalName as my nameID")

Note that I lookup the username from LDAP based on the principal name
(i.e., I don't use the PrincipalName attribute definition direcly),
which gives me PrincipalName "canonicalization" "for free"
(mostly UPPER/lower/miXEdcase cleanup) because the usernames are
stored and returned consistently in LDAP, but will be found when
looked up in arbitrary variations (i.e., as entered in the web form
during authentication).
> 
> If I understand correct TransientId and PersistentId require a mail like
> format and because I am getting something that is just any string, I want
> to get in unspecified format.

Not so.
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTransientNameIdentifier
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPPersistentNameIdentifier
Or see section 8.3 of the current spec:
http://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf
Nowhere does it mention "mail like" values for any of the NameID
formats you mention.

> - Commented away the original attribute called transientId which contains 2
> attribute encoders of transient format in attribute-resolver.xml

Don't do that, you might need it for other use cases (some SPs insist
on a recieving /any/ NameID and transient comes in handy there).
Instead set a NameID precedence list as per the documentation or setup
your attribute filter accordingly.

> No attribute of principal 'someString' can be encoded in to a
> NameIdentifier of required format
> 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party '
> https://myhost.com/'
> 
> 
> I don't understand why it keeps saying that it wants a transient format
> (Which I believe is what is stopping it from adding to nameId due to no
> mail format).

Not sure, possibly the SP requested this NameID format explicitly.

> Any help is appreciated, am I doing something wrong?
> 
> I based my actions on the following page
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeExamples
> with the small change that I am using a principalName
> attributeDefinition type instead of Simple.

Also check out the other NameID-related thread today.
-peter