correct nameid-format

[Michael Dahlberg]

Would "nameid-format:emailAddress" be significantly different from
"nameid-format:persistent"?

This is the encoding I have for the specific attribute I'm releasing:

<resolver:AttributeDefinition id="cnIdentifiedName"
xsi:type="ad:PrincipalName">
        <resolver:Dependency ref="commonName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>


I thought that if I released the nameid in the form of an email address
that I wouldn't need to release any other attributes.

Thanks, Kevin.

Mike

On Thu, Oct 9, 2014 at 11:33 AM, Kevin Foote <kpfoote at uoregon.edu> wrote:

> On Oct 9, 2014, at 8:18 AM, Michael Dahlberg <olgamirth at gmail.com> wrote:
>
> > I'm trying to configure our IdP for an external SP (widencollective.com).
> Authentication is successful (for the user "testuser") but immediately
> after that, I get an error page from the SP that states that "the access
> request was malformed".  My logs show the following:
> >
> > 10:59:41.442 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491]
> - No attribute of principal 'testuser' can be encoded in to a
> NameIdentifier of required format
> 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' for relying party '
> https://bucknell.widencollective.com'
> > 10:59:41.454 - INFO [Shibboleth-Audit:1028] -
> 20141009T145941Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4e53a5ba-696d-4e6e-995f-ef4bec816e1b|
> https://bucknell.widencollective.com
> |urn:mace:shibboleth:2.0:profiles:saml2:sso|
> https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||
> >
> >
> > In the attribute-filter.xml file, I deny the transientID and provide the
> attribute cnIdentifiedName, which is an SAML 2.0, persistent nameid
> attribute:
>
> Your attribute may follow the spec of a persistent named attribute but, Is
> the attribute properly encoded for the nameID type specified?
> You have to encode this attribute in your attribute-resolver.xml to the
> the proper nameID format specified for that SP?  Something like the
> following needs to be added
> to your <AttributeDefinition>
>
>  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
>
> You then have to release the attribute like normal and deny release of
> others like you did with transientId…
>
> HTH
>
> --------
> thanks
>  kevin.foote
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141009/8f4571a1/attachment.html