Google Apps with IdPv3

[Cantor, Scott]

> Has anybody managed to generate a response accepted by Google Apps
> with a new IdPv3 install, i.e. a response containing unspecified nameid
> format?

You want to follow the wiki page on generation of NameIDs and look at the brief discussion around creating a custom one:

https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration

"If you want custom values based on an attribute, uncomment one or more copies of the example bean(s) appropriately and ensure the underlying source attribute(s) are released to the applicable relying party or parties."

So basically get the underlying data attribute defined and released to Google. Then modify/copy the example in the saml-nameid.xml file to configure a generator that pulls from that source attribute and set the format to unspecified.

You can enable the generator explicitly for Google if you have to, but the simplest way to control data release is still through the filter by limiting who gets the underlying attribute. Then the NameID just becomes a particular way some SPs receive that data.

-- Scott