how to release uid as nameid

[Kevin Foote]

On 3/20/14, 12:50 PM, "Qian, Yi" <yqian at ku.edu> wrote:

>
>The vendor request us to use uid  as nameid,  such as
><saml:subject>
>    <saml:nameid>yqian</saml:nameid>
></saml:subject>
>
>
>And in their metadata, they listed nameid format as
><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:entity</md:Name
>IDFormat>
>
>
>
>So I tried add following definition in resolver.xml
><resolver:AttributeDefinitionxsi:type="ad:Simple"id="releasedUId"sourceAtt
>ributeID="uid">
>        <resolver:Dependencyref="myLDAP"/>
>        
><resolver:AttributeEncoderxmlns="urn:mace:shibboleth:2.0:attribute:encoder
>"xsi:type="SAML2StringNameID"nameFormat="urn:oasis:names:tc:SAML:1.1:namei
>d-format:entity"/>
>    </resolver:AttributeDefinition>

You should be able to see in the IdP logs that it is picking one of the
available candidates to populate the NameID value. The release filter will
pick a random NameID out of the pool of available candidates it has when
it is run. 

You can set up a specific relying party config for that RP. You may also
have to suppress the release of some NameID values like ³transient² for
that particular RP.  You can also rely on the RP¹s metadata to supply the
format value. 



------
thanks,
 kevin.foote