IDP-initiaded SSO or IdPUnsolicitedSSO

[Cantor, Scott]

On 10/18/13 10:01 AM, "Jehan Procaccia" <Jehan.Procaccia at it-sudparis.eu>
wrote:
>
>the vendor told me that they are waiting for this kind of format
>urn:oasis:names:tc:SAML:1.1:nameid-format:Unspecified "

That's not valid, unless you were mistaken about the case. The last
segment is "unspecified", not "Unspecified".

It's also not a good choice, but that aside.

You will have to encode with that format, and you will need to release
that attribute to the SP, and you will need to suppress/block release of
the normal transient and legacy formats by blocking release of the
transientId attribute to that SP.

But actually, I don't know that I'm correct about "unspecified" not being
usable in the precedence setting in the relying-party file. I think people
are doing that to make Google work.

>but it is still not clear to me what is the AttributeName, I'am waiting
>for a reponse from the vendor regarding that AttributeName ...

I doubt they use an Attribute at all.

>For now with my actual configuration I am sending :

You are misapplying the legacy transient format. Stop doing that.

>I still want to send my email address as the NameIdentifier for that SP,
>not the default transientId, how can I force my shibboleth IDP to do so ?

See above.

-- Scott