problems seemingly caused by transientID in O365

[Rob Gorrell]

gotcha, i'm learning something here. so since I'm after releasing a custom
nameid to this SP, it would look like:

   <rp:RelyingParty id="urn:federation:MicrosoftOnline" provider="
https://prdidp.uncg.edu/idp/shibboleth"
         defaultSigningCredentialRef="IdPCredential"
nameIDFormatPrecedence="ImmutableID">

correct? or is that not the right syntax to reference "custom" nameid's?
my resolver definition for the nameid I'd like to use looks like the
following:

<!-- Use AD objectGUID as ImmutableID for Windows Azure AD -->
    <resolver:AttributeDefinition id="ImmutableID" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
             sourceAttributeID="sourceObjectGuid">
         <resolver:Dependency ref="myAD" />
         <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

 nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
    </resolver:AttributeDefinition>



On Wed, Aug 27, 2014 at 9:31 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 8/27/14, 9:27 AM, "Rob Gorrell" <rwgorrel at uncg.edu> wrote:
> >
> >Can you elaborate a little more on the precedence setting in
> >relying-party? In this particular case, the SP is Microsoft's O365 where
> >they don't provide us any control over setting the NameID format in their
> >metadata, so I'm not sure that is an available option with this
> >particular SP.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty
>
> nameIDFormatPrecedence
>
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140827/8a7094ae/attachment.html