Problem passing attribute once upgrading to version 3

[McKean, Brandon Scott - mckeanbs]

Hi Todd,
I had to mess with something very similar for configuring ArcGIS.
Here's what I had to do for this:
Here's what I did in saml-nameid.xml:
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"
            p:attributeSourceIds="cn" />
The eid part is arbitrary, you just need to keep it consistent across
the config You can have it be emailaddress too.
Then, in relying-party.xml:
<bean parent="RelyingPartyByName" c:relyingPartyIds="JMU.maps.arcgis.com">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"/>
		</list>
            </property>
        </bean>        
        
Hope this snippet helps.
 

-- 
Brandon McKean
IT / Systems
Linux Administrator (540)568-4235       
On Wed, 2015-07-15 at 15:54 -0400, Todd Vernick wrote:
> My SP requires the assertion:
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
> or
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
> 
> I used the following config to pass uid to pass this in shibboleth
> version 2
> 
> attribute_resolver.xml
>     
> sourceAttributeID="uid">
>         <resolver:Dependency ref="myLDAP" />
>         
> xsi:type="enc:SAML1StringNameIdentifier"
> nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
>         
> name="urn:mace:dir:attribute-def:uid" />
>         
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
>     
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
>     </resolver:AttributeDefinition>
> 
> relying_party.xml
>         <rp:RelyingParty
>                 id="
> http://fs.ultiproworkplace.com/adfs/services/trust"
>                 provider="https://idp.squarespace.net/idp/shibboleth"
>                
> defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:u
> nspecified"
>         defaultSigningCredentialRef="IdPCredential">
> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
>         includeAttributeStatement="true"
>         assertionLifetime="300000"
>         assertionProxyCount="0"
>         signResponses="conditional"
>         signAssertions="never"
>         signRequests="conditional"
>         encryptAssertions="never"
>         encryptNameIds="never"
> />
>         </rp:RelyingParty>
> 
> 
> Version 3 carried over a different relying_party config
>         
> http://fs.ultiproworkplace.com/adfs/services/trust">;
>             <property name="profileConfigurations">
>                 <list>
>                     
> p:encryptAssertions="false" />
>                 </list>
>             </property>
>         </bean>
> 
> And I used the same attribute_resolver config for version 3.
> When decoding the saml response, it's not showing a 1.1:nameid-format
> anymore, only 2.0 formats.
> -- 
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/6826f488/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/6826f488/attachment-0001.bin>