No NameID released

[David Bantz]

Thanks Kevin and Scot.  I think I see.  While there’s no explicit deny (in any policy for any attribute in my attribute-filter as it happens)
prior to explicitly adding the release of transientId to the policy for this service, there was no explicit rule for
transientId in an applicable policy.  I was wrong about releasing transientId to any service - that’s commented out as historic and
replaced with release transientId to InCommon members, and, alas, AWS is not an InCommon member.

So in the absence of applicable explicit applicable policy releasing it, transientId cannot be used for NameID - correct?
It wasn’t clear in my head that the NameID in the subject had to be based on an attribute that can be released to the relying party;
before I commit that to long term memory can you just confirm I’ve finally got it right?  Or correct me if still needed?

Thank you!

David Bantz
 
On Mon, 11 Aug 2014, at 15:44 , Kevin Foote <kpfoote at uoregon.edu> wrote:

> On Aug 11, 2014, at 4:16 PM, David Bantz <dabantz at alaska.edu> wrote:
> 
>> 09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:504] - No attributes for principal 'dabantz' support encoding into a supported name identifier format for relying party ‘urn:amazon:webservices’
> 
> 
> Your last DEBUG line is telling you exactly what is “wrong”  
> You have to be missing some thing in your reported config. 
> 
> We can not see the remainder of you filter file .. an explicit deny on transient is still possible. We can only guess and report what we have experience with :-) I have missed blocking or unblocking attributes which resulted in this - obviously :)
> 
> --------
> thanks
> kevin.foote
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140811/10696ecb/attachment.bin