IdP: Returning emailAddress as NameId in SAMLResponse Assertion

[vyal2k]

Thanks. 
I commented out the "AttributeFilterPolicy" for "transientId" AttributeRule and now there is no response from IdP and i see the following in idp-process.log:

21:34:27.889 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal 'user1' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' for relying party 'https://inw00003973:8443'


Thanks,
Vasu


________________________________
 From: Kevin P. Foote <kpfoote at iup.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Thursday, 21 November 2013 7:13 PM
Subject: Re: IdP: Returning emailAddress as NameId in SAMLResponse Assertion
 



On Thu, 21 Nov 2013, vyal2k wrote:

>  I am trying to have IdP return email address as the NameId in the Assertion (in response AuthnRequest). But the returned nameId value (in decrypted Assertion) is some sort of code "_3ad95a453140ebc4894b5777f58096e2" instead of the authenticated user's email address (in LDAP) that i was expecting.
>
> Here is attribute-resolver.xml at IdP:
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>     </resolver:AttributeDefinition>
>     
> Here is attribute-filter.xml at IdP:
> <afp:AttributeFilterPolicy id="citrixShareFile_nameID">
> <afp:PolicyRequirementRule xsi:type="basic:ANY" />
> <afp:AttributeRule attributeID="email">
> <afp:PermitValueRule xsi:type="basic:ANY" />
> </afp:AttributeRule>
> </afp:AttributeFilterPolicy>
>
> SP configuration at IdP: <SPSSODescriptor> includes:
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
>
> And the AuthnRequest contains:
> <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>
> Please let me know how to have IdP return authenticated user's email address to the SP.

You are probably not removing the Transient NameId from the available
attributes at your filter.

This was just on a thread about 3 weeks ago..

You need to place a DenyValueRule for the TransientId in your filter
rules for that entity.


------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131121/0db01c00/attachment.html