SAML Salesforce Reponse coming in Transient Format

[Cahill, Charles (GE Appliances)]

From: Cahill, Charles (GE Appliances)
Sent: Friday, November 13, 2015 11:19 AM
To: 'users'
Subject: SAML Salesforce Reponse coming in Transient Format

Hey All:

              Can anyone tell me why the response from Shibboleth back to SalesForce is coming
              As transient, which seems to be making the NameID attribute unreadable?

        <saml2:Subject>
        <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                   NameQualifier="xxxxxxx.com"
                   >_8f7108256ebafbcd28e337cc56444e3f</saml2:NameID>
        <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml2:SubjectConfirmationData Address="xxxxxx"

              Here are the associated configs

              <rp:RelyingParty
              id="https://xxxxxx.salesforce.com" provider="xxxxx.com"
              defaultSigningCredentialRef="IdPCredential"
                  defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
              nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
              <rp:ProfileConfiguration
              xsi:type="saml:SAML2SSOProfile"
              encryptAssertions="never"
              signResponses="always" signAssertions="always"           />
              </rp:RelyingParty>

              <!--SalesForce Filter Configs -->
              <afp:AttributeFilterPolicy id="NameID4SalesForce">
                             <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="httpsxxxxxx.salesforce.com" />
              <afp:AttributeRule attributeID="NameID">
             <afp:PermitValueRule xsi:type="basic:ANY" />
                             </afp:AttributeRule>
              </afp:AttributeFilterPolicy>

              <!--NameID Custom Resolver Configs -->
              <resolver:AttributeDefinition xsi:type="ad:Simple" id="NameID" sourceAttributeID="uid">
                             <resolver:Dependency ref="uid" />
                             <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
                             nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
              </resolver:AttributeDefinition>

Thanks !

Charles Cahill
Senior Technologist - Authentication/Authorization
TAS App Svcs, SSO/LDAP/Web Application Support
GE Appliances & Lighting

GE Appliance Park
Louisville, Ky/40225

GE imagination at work

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151113/9492cfc6/attachment-0001.html>