No NameID released

[David Bantz]

I do not understand why my IdP did not release a NameID in the subject portion of the SAML assertion to a particular relying party.
I’ve reviewed https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

I was able to send the transientID value as NameID by adding it explicitly to the attribute release policy for this SP, so I’ve resolved the operational issue, but I would like to know why the ‘releaseTransientIdToAnyone’ policy did not cover this case.

the SP metadata includes:
   <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>

The IdP builds a TransientID:
09:15:25.234 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:97] - Building transient ID for request _3243897b9f3596fc1ccfb93040b1b10b; outbound message issuer: urn:mace:incommon:alaska.edu, inbound
 message issuer: urn:amazon:webservices, principal identifer: dabantz
09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:115] - Created transient ID _7a768c0d4ad1ad93e9623e5f23421e87 for request _3243897b9f3596fc1ccfb93040b1b10b
09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute transientId containing 1 values

The attribute-filter contains the rule:
    <AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <PolicyRequirementRule xsi:type="basic:ANY" />
        <AttributeRule attributeID="transientId">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>

Yet the IdP releases no NameID to this service:
09:15:25.423 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:527] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSsessionID, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSrole, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:504] - No attributes for principal 'dabantz' support encoding into a supported name identifier format for relying party 'urn:amazon:webservices'

resulting in a ‘nameless’ subject in the SAML assertion:
<saml2:Subject>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="137.229.6.68" NotOnOrAfter="2014-08-11T16:25:38.711Z" Recipient="https://signin.aws.amazon.com/saml"/>
</saml2:SubjectConfirmation>
</saml2:Subject>

For OTHER relying parties /  SPs the IdP uses TransientID for the NameID, as in:
09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:868] - Using attribute 'transientId' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party 'https://secure.aleks.com/shibboleth-sp'
09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:733] - Attempting to encrypt NameID to relying party 'https://secure.aleks.com/shibboleth-sp'
Value = org.opensaml.saml2.core.impl.NameIDImpl at 3cb8e2d7



David Bantz
UA IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140811/b3e2c1b7/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140811/b3e2c1b7/attachment.bin