SAML2StringNameID format

[Cantor, Scott]

On 6/10/14, 10:49 AM, "Michael Dahlberg" <olgamirth at gmail.com> wrote:
>
>However, (and again my apologies if the answer is readily discoverable),
>I tried adding this to the metadata for the SP:
><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQu
>alifiedName</md:NameIDFormat>
>
>(we can use the WindowsDomainQualifiedName or the emailAddress) and I get
>the following error when attempting to login:

Then I would imagine they don't accept that Format value. The example they
provided did not, certainly, they used unspecified (which is wrong, but
that's not the issue, they require what they require).

Guessing like this is really not a good use of anybody's time. They need
to tell you.

You should also verify from the audit log that you're sending the NameID
value you intend to be.

>Any suggestions on what the problem may be?

Yes, you're guessing blindly at what a system you don't control is
expecting. At minimum, I'd suggest you give it exactly what they're asking
for. But I don't think you can actually trigger this with metadata, I
think the IdP ignores the "unspecified" format in metadata, since that
literally should mean they're not looking at the Format. So you'd probably
need to define this in relying-party.xml with a precedence property, the
second option I gave.

>  Also, any suggestions on how to add a NameIDFormatPrecedence attribute
>to a RelyingParty definition?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty

>Also, could you tell me what Nate meant by the NameIDs should be encoded
>as the Subject of an assertion?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes

-- Scott