Question about webex and nameid format

[Christopher Bongaarts]

On 9/6/2013 2:58 PM, Joy Veronneau wrote:
> Hi,
>
> I have a working webex implementation with Shibboleth 2.3.3 and java 
> 1.5. I am trying to complete an upgrade to Shibboleth 2.4 and java 1.7.
>
> When I do the upgrade in my test environment, things seem to work ok 
> except for the webex configuration.
>
> The shib 2.3.3 debug log shows this:
> 14:35:45.085 - DEBUG 
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483] 
> - Name identifier for relying party 'http://www.webex-test.com' 
> <http://www.webex-test.com%27> will be built from attribute*'webexID'*
>
> while under 2.4 (and 2.3.8), the debug log shows this:
> 12:07:31.903 - DEBUG 
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:850] 
> - *Using attribute 'transientId' *supporting NameID format 
> 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the 
> NameID for relying party 'http://www.webex-test.com' 
> <http://www.webex-test.com%27>
>
> I am not sure why this would be? It must be a config issue somewhere 
> but I can't find it.  I want it to send webexID in format unspecified, 
> not transientId in format transient.

Do you have an attribute filter rule that releases transient by 
default?  If so, make sure you either exclude webex-test or add an 
explicit Deny rule in the webex-test filter policy.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130906/796cbd57/attachment.html