IdP: Returning emailAddress as NameId in SAMLResponse Assertion

[Kevin P. Foote]

On Thu, 21 Nov 2013, vyal2k wrote:

>  I am trying to have IdP return email address as the NameId in the Assertion (in response AuthnRequest). But the returned nameId value (in decrypted Assertion) is some sort of code "_3ad95a453140ebc4894b5777f58096e2" instead of the authenticated user's email address (in LDAP) that i was expecting.
>
> Here is attribute-resolver.xml at IdP:
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>     </resolver:AttributeDefinition>
>     
> Here is attribute-filter.xml at IdP:
> <afp:AttributeFilterPolicy id="citrixShareFile_nameID">
> <afp:PolicyRequirementRule xsi:type="basic:ANY" />
> <afp:AttributeRule attributeID="email">
> <afp:PermitValueRule xsi:type="basic:ANY" />
> </afp:AttributeRule>
> </afp:AttributeFilterPolicy>
>
> SP configuration at IdP: <SPSSODescriptor> includes:
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
>
> And the AuthnRequest contains:
> <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>
> Please let me know how to have IdP return authenticated user's email address to the SP.

You are probably not removing the Transient NameId from the available
attributes at your filter.

This was just on a thread about 3 weeks ago..

You need to place a DenyValueRule for the TransientId in your filter
rules for that entity.


------
thanks
  kevin.foote