SAML2StringNameID format

[UA]

I'm working also to integrate ArcGIS; the attribute resolver def they provide in online documentation (which you quoted) seems to be set to release whatever is flagged as the principal in the resolver; at least for our case that depends on how the user authenticates and is determined by the IdP; that is, not assured to be the same value each time for a given user.  It has seemed to me necessary to define a new attribute for this service that is stable and represents the user to this service, but uses the encoder requested.

David.Bantz at me.com
David.Bantz at Alaska.edu


> On Jun 9, 2014, at 11:48 AM, Michael Dahlberg <olgamirth at gmail.com> wrote:
> 
> Nate and Christopher:
> 
> You may be right about not giving me enough info about what they're looking for because in their docs they just say 
> 
> add this to attribute-resolver.xml
> 
>  <!-- Name identifier for passing principal name to ArcGIS Online -->
>     <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
>         <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>             nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
>     </resolver:AttributeDefinition>
> 
> and this to attribute-filter.xml
> 
>  <!-- Release the NameID to city.maps.arcgis.com -->
>     <afp:AttributeFilterPolicy>
>         <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="city.maps.arcgis.com" />
>         <afp:AttributeRule attributeID="principal">
>             <afp:PermitValueRule xsi:type="basic:ANY"/>
>         </afp:AttributeRule>
>     </afp:AttributeFilterPolicy>
> 
> My problem is that the attribute that is released and/or the one that they are using is the transientID and I really need them to use the email address.
> 
> How can one deny the release of an attribute?
> 
> Thanks,
> Mike
> 
> 
> 
>> On Mon, Jun 9, 2014 at 3:34 PM, Christopher Bongaarts <cab at umn.edu> wrote:
>> On 6/9/2014 2:25 PM, Michael Dahlberg wrote:
>> > I'm running a Shibboleth 2.40 IdP and am trying to release the email
>> > address attribute to the SP.  The SP asks that the attribute encoder
>> > be of type SAML2StringNameID.  I assume I need to modify the
>> > nameFormat parameter from the default specification:
>> > "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" to something
>> > else.  Any suggestions would be most helpful.
>> 
>> You don't have to, but it's not a bad idea, perhaps to:
>> 
>> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
>> 
>> Remember that NameID is a Highlander-class attribute (there can be only
>> one), so be sure to set up your attribute filter for this SP
>> appropriately (typically by adding a deny all values rule for
>> transientId if you're using the default release-to-everyone filter for it).
>> 
>> --
>> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
>> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
>> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140609/783e79ba/attachment-0001.html