SAML2StringNameID format

[Christopher Bongaarts]

On 6/9/2014 2:25 PM, Michael Dahlberg wrote:
> I'm running a Shibboleth 2.40 IdP and am trying to release the email 
> address attribute to the SP.  The SP asks that the attribute encoder 
> be of type SAML2StringNameID.  I assume I need to modify the 
> nameFormat parameter from the default specification: 
> "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" to something 
> else.  Any suggestions would be most helpful.

You don't have to, but it's not a bad idea, perhaps to:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Remember that NameID is a Highlander-class attribute (there can be only 
one), so be sure to set up your attribute filter for this SP 
appropriately (typically by adding a deny all values rule for 
transientId if you're using the default release-to-everyone filter for it).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%