correct nameid-format

[Kevin Foote]

On Oct 9, 2014, at 8:18 AM, Michael Dahlberg <olgamirth at gmail.com> wrote:

> I'm trying to configure our IdP for an external SP (widencollective.com).  Authentication is successful (for the user "testuser") but immediately after that, I get an error page from the SP that states that "the access request was malformed".  My logs show the following:
> 
> 10:59:41.442 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal 'testuser' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' for relying party 'https://bucknell.widencollective.com'
> 10:59:41.454 - INFO [Shibboleth-Audit:1028] - 20141009T145941Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4e53a5ba-696d-4e6e-995f-ef4bec816e1b|https://bucknell.widencollective.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||
> 
> 
> In the attribute-filter.xml file, I deny the transientID and provide the attribute cnIdentifiedName, which is an SAML 2.0, persistent nameid attribute:

Your attribute may follow the spec of a persistent named attribute but, Is the attribute properly encoded for the nameID type specified? 
You have to encode this attribute in your attribute-resolver.xml to the the proper nameID format specified for that SP?  Something like the following needs to be added 
to your <AttributeDefinition>

 <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />

You then have to release the attribute like normal and deny release of others like you did with transientId… 

HTH

--------
thanks
 kevin.foote