Problem passing attribute once upgrading to version 3

[Cantor, Scott]

On 7/15/15, 3:54 PM, "users on behalf of Todd Vernick" <users-bounces at shibboleth.net on behalf of tvernick at squarespace.com> wrote:

>My SP requires the assertion:
>nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
>
>or
>nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Then you should use the latter preferably.

>I used the following config to pass uid to pass this in shibboleth version 2

You can use the deprecated features if desired, or the other poster described how to do it with the new NameID components and config. Either way still requires something be done to actually select the format to use.

>Version 3 carried over a different relying_party config

If you're using that instead of the old version, then setting the precedence property looks like this:

>        <bean parent="RelyingPartyByName" c:relyingPartyIds="http://fs.ultiproworkplace.com/adfs/services/trust">
>            <property name="profileConfigurations">
>                <list>
>                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
>p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>                </list>
>            </property>
>        </bean>

>When decoding the saml response, it's not showing a 1.1:nameid-format anymore, only 2.0 formats.

Those are constants that signal specific semantics and the old constants are still valid in SAML 2. The formats are what they are. If the format changed, then your selection process has changed.

There are two parts to all this:

- supporting a NameID format
- selecting a NameID format

The former can be done either in the attribute resolver or in the saml-nameid.xml file (often along with some attribute produced by the resolver). The latter has *never* been a resolver function. It can be done in three ways:

- SP specifying a NameIDPolicy in its request
- SP metadata
- the nameIDFormatPrecedence property in a profile configuration

The only change in V3 was the bit about putting "unspecified" in the metadata, and I added that to the release notes page which I forgot to do when Peter pointed out it was a change to V2 behavior.

-- Scott