Making urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified a supportable identifier format

[Cantor, Scott]

On 6/11/15, 9:09 PM, "users on behalf of Alain O'Dea" <users-bounces at shibboleth.net on behalf of alain.odea at gmail.com> wrote:

>If I hack the format I get NameID values I can't use.  I need the email address on the SP.  I don't want to do anything that will compromise my SP's support for other IdPs.

SPs should use Attributes not NameIDs. You don't want to bother with NameIDs, they're limiting and brittle. The only NameID types that should ever be used are transient and persistent. The former is only used to support extended use cases like logout, otherwise you just omit it.

>I have the following in conf/attribute-resolver-ldap.xml:

Assuming this is V3, that's not the suggested way to handle NameID generation anymore, but regardless, your issue here is that you have the wrong constant. The unspecified constant should be as you have in your resolver, but the value the SP's metadata has is incorrect, it's got "2.0" in the constant string instead of 1.1.

And in any case, using the real constant in the SP's metadata will do nothing. The IdP will ignore it because you told it you didn't care what the format is (that's what "unspecified" means).

-- Scott