Name Identifier attribute release

Michael Dahlberg olgamirth at
Wed Aug 19 09:36:27 EDT 2015

I'm still having a bit of a problem returning an attribute encoded in the
SAML2 Name Identifier ... thanks for your continued assistance.

I've made the following modifications:

In attribute-resolver.xml:

    <resolver:AttributeDefinition id="pageUp" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="cn">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="SAML2StringNameID"

nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent" />

The cn attribute is one that is released by the data connector referenced
in myLDAP and contains the username of the authenticated user

In attribute-filter.xml:

xsi:type="basic:AttributeRequesterString" value="" />

        <afp:AttributeRule attributeID="pageUp">
            <afp:PermitValueRule xsi:type="basic:ANY" />


Seems pretty basic once you comprehend what a Name Identifier is (I'm still
learning that myself)

However, a SAML tracer result shows the following (I've just included the
SAML2 subject for clarification):


                <saml2:SubjectConfirmationData Address=""




It looks as if the NameID value is the transientId, not the cn.  I have no
idea why the transientId is returned rather than the cn from the
configurations listed above.

Any suggestions will be appreciated.  Also, if you feel so inclined to
point out my terminology mistakes, I would appreciate that as well ...
being able to accurately describe the problem is 75% of the battle.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the users mailing list