Problem sending email address as NameID in subject

[Andrew Cheung]

Hi, Peter. Thanks for the pointers. I fixed a few mistakes on the
permissions that releases the attribute so that for each specific SP (I
have a couple additional ones in the file which I did not list), it only
releases the specified attribute. I have also fixed the format to email
address in the metadata as well as in the attribute-resolver.xml files.
However it is still putting the "cn" from eDirectory (which is the
username) into the NameID field.

Any ideas?

 -Andrew


The configurations now look like the following:

attribute-filter.xml:

 <afp:AttributeFilterPolicy id="doNotReleaseTransientIdToAnyoneMySiteA">
  <afp:PolicyRequirementRule xsi:type="basic:NOT">
    <basic:Rule xsi:type="basic:AttributeRequesterString" value="
mail.google.com/a/dev.mySiteA.ca" />
  </afp:PolicyRequirementRule>
   <afp:AttributeRule attributeID="transientId">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>

<afp:AttributeFilterPolicy id="releaseGoogleMySiteAEmail">
  <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com/a/dev.mySiteA.ca"/>
  <afp:AttributeRule attributeID="GoogleMySiteAEmail">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>


----------------
attribute-resolver.xml:

<resolver:AttributeDefinition xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              id="GoogleMySiteAEmail"
                              sourceAttributeID="email">
 <resolver:Dependency ref="myLDAP" />
   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>


-------------------------

googleMySiteA-metadata.xml :

<EntityDescriptor entityID="google.com/a/dev,mySiteA.ca"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/dev.mySiteA.ca/acs" />
    </SPSSODescriptor>
</EntityDescriptor>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150120/85706a4d/attachment.html