SAML2StringNameID format

[Michael Dahlberg]

Nate and Christopher:

You may be right about not giving me enough info about what they're looking
for because in their docs they just say

add this to attribute-resolver.xml

 <!-- Name identifier for passing principal name to ArcGIS Online -->
    <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
        <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
    </resolver:AttributeDefinition>

and this to attribute-filter.xml

 <!-- Release the NameID to city.maps.arcgis.com -->
    <afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="city.maps.arcgis.com" />
        <afp:AttributeRule attributeID="principal">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

My problem is that the attribute that is released and/or the one that they
are using is the transientID and I really need them to use the email
address.

How can one deny the release of an attribute?

Thanks,
Mike



On Mon, Jun 9, 2014 at 3:34 PM, Christopher Bongaarts <cab at umn.edu> wrote:

> On 6/9/2014 2:25 PM, Michael Dahlberg wrote:
> > I'm running a Shibboleth 2.40 IdP and am trying to release the email
> > address attribute to the SP.  The SP asks that the attribute encoder
> > be of type SAML2StringNameID.  I assume I need to modify the
> > nameFormat parameter from the default specification:
> > "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" to something
> > else.  Any suggestions would be most helpful.
>
> You don't have to, but it's not a bad idea, perhaps to:
>
> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
>
> Remember that NameID is a Highlander-class attribute (there can be only
> one), so be sure to set up your attribute filter for this SP
> appropriately (typically by adding a deny all values rule for
> transientId if you're using the default release-to-everyone filter for it).
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140609/b4aa43a9/attachment-0001.html