Send additional Atrributes in nameid format

[Nate Klingenstein]

Krrishv,

It's usually a bad idea to send a real attribute like givenName as an unspecified nameID.  Is there a reason you need to do this?  Can you talk to the SP?

If it is indeed required, and you continue to have problems, you probably need to set priorities for nameID generation for the relying party in question.  See IdP Name Identifier Selection Process:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

Thanks,
Nate.

On Jan 24, 2014, at 12:43 PM, krrishv <krish.v at gmail.com>
 wrote:

> Hi,
> 
> I would like to send additional attributes like mail, firstname in the
> unspecified nameid format in attribute statement. When i try to create a
> attribute map in resolver file as below.
> 
> <resolver:AttributeDefinition xsi:type="SAML2NameID"
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>                              id="FirstName"
>                              sourceAttributeID="givenname"
> 
> nameIdFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
> 
>     <resolver:Dependency ref="myLDAP" />
> 
> </resolver:AttributeDefinition>
> 
> and in filter i have the below release policy.
> 
>  <AttributeRule attributeID="FirstName"> 
>        <PermitValueRule xsi:type="basic:ANY" /> 
>    </AttributeRule>
> 
> I don't see the attribute getting released.  Can someone help.
> 
> 
> 
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Send-additional-Atrributes-in-nameid-format-tp7594293.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net