SAML2StringNameID format

[Michael Dahlberg]

On Mon, Jun 9, 2014 at 3:46 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/9/14, 3:34 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
> >
> >Remember that NameID is a Highlander-class attribute (there can be only
> >one), so be sure to set up your attribute filter for this SP
> >appropriately (typically by adding a deny all values rule for
> >transientId if you're using the default release-to-everyone filter for
> >it).
>
> I don't advise that at this point, all you need to do is one of:
>
> - add a <NameIDFormat> of the appropriate value to the SP's metadata
> - or if you don't control or don't want to modify the metadata, add a
> nameIDFormatPrecedence attribute to a RelyingParty definition for the SP
>
>
I like these two options: much better than making changes to the default
config which would effect all the SPs.

However, (and again my apologies if the answer is readily discoverable), I
tried adding this to the metadata for the SP:
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</md:NameIDFormat>

(we can use the WindowsDomainQualifiedName or the emailAddress) and I get
the following error when attempting to login:

Unable to login using Idp Error parsing 'NAME_ID' from SAML response

and I only get a warning in the idp-process.log file:
[org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder:134] - Relay
state exceeds 80 bytes, some application may not support this.

Any suggestions on what the problem may be?  Also, any suggestions on how
to add a NameIDFormatPrecedence attribute to a RelyingParty definition?

Also, could you tell me what Nate meant by the NameIDs should be encoded as
the Subject of an assertion?

Thanks very much,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140610/408a820b/attachment-0001.html