a simple recipe for copying attribute into Subject/NameID

[Peter Schober]

* Jason Winshell <jason at jasonwinshell.com> [2013-06-29 02:46]:
> I need my NameID policy to X509Subject to work for my specific
> purpose. So far I've had to set it to transient to get Shibboleth to
> not produce an error about an unsupported NameID policy.

If your SP is specifically requesting a NameID format of
"urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName" my
previous explanation on how to release the "uid" standard attribute
from an LDAP DSA as a SAML2 "unspecified" NameID won't help.

Requesting specific NameID formats assumes that your IdP can handle
those (or it will need to return an error, as you've seen).

The value of "uid" (your example) is not a X.509 subject name,
though. You'd need to create another attribute defintion for that and
get the DN of that object from the DSA
(e.g. "uid=foo,dc=example,dc=org"), e.g. via the entryDN operation
attribute some DSA implementations support.

Then add a NameID encoder with the proper NameID format (from the
spec: "urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName") to
it. Then your IDP should be able to satisfy a request for that
specific NameID format.
-peter