Correct attribute to filter

[Ian Rifkin]

Hi Mike,

It sounds like you're on the right track. It sounds like they're looking at
the NAME ID
<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier>
(which is part of the subject in the SAML response from your IdP).

You need to setup a name id attribute
<https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringNameIDEncoder>
with the data you want in your resolver then add that (and deny the
transient id one) in your attribute-filter.

Hope that helps!

Ian

I've configured my IdP to release the userPrincipalName
>
 …

> and, by default, the transientId is released as well:
>
…

> Is there any way I can create an attribute like the transientId that will
> include 'NAME_ID' (not sure what that is) that I can then pass to the SP
> with a consistent, easily recognizable value?
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140826/568a1c4c/attachment.html