Name Identifier attribute release

[Michael Dahlberg]

On Wed, Aug 19, 2015 at 10:36 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 8/19/15, 9:36 AM, "users on behalf of Michael Dahlberg" <
> users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:
>
>
>
> >
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent" />
>
> That's for opaque, pairwise identifiers only, so you should not be using
> it here.
>
> >The cn attribute is one that is released by the data connector referenced
> in myLDAP and contains the username of the authenticated user
>
> If you're populating the subject with the value of an arbitrary attribute,
> and no existing Format applies, you should use the URI of the SAML
> Attribute Name as the NameID Format.
>
> >It looks as if the NameID value is the transientId, not the cn.  I have
> no idea why the transientId is returned rather than the cn from the
> configurations listed above.
>
> Releasing an attribute is necessary, but not sufficient, you still have to
> address which Format is actually selected. The wiki documents the NameID
> Format selection process, and absent any other input, it's basically
> random. If you want to use a Format with a particular SP, you either put it
> in the SP's metadata in a NameIDFormat element, or use the RelyingParty
> nameIDFormatPrecedence setting.
>
>
Great, I think I should be able to work this out.

One last question: Is it fairly common to release an arbitrary attribute to
an SP in the SAML2 Subject?  I'm working with a number of SPs and this is
the first one that required the attribute released in the Subject.

Thanks again,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150819/3d22451d/attachment.html>