Using cn (commonName) as NameID

[Doan, Tommy]

I believe Robo is missing the reference to a data connector in his attribute definition. Below is how we use CN in case it helps. 

attribute-resolver.xml
<resolver:AttributeDefinition xsi:type="ad:Simple" id="commonName" sourceAttributeID="cn">
  <resolver:Dependency ref="myLDAP" />
  <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:cn" />
  <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.3" friendlyName="cn" />
</resolver:AttributeDefinition>

attribute-filter.xml
<afp:AttributeFilterPolicy id="releaseExample" >
  <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://example.edu/shibboleth" />
  <afp:AttributeRule attributeID="commonName">
  <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, November 24, 2015 9:17 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using cn (commonName) as NameID

On 11/24/15, 9:41 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:



>On 11/24/15, 7:49 AM, "users on behalf of Robo Burned" <users-bounces at shibboleth.net on behalf of robo at list.ru> wrote:
>>I need 'cn' or commonName to be placed into Subject / NameID of SAML response.
>>I've added the attribute definition to the attribute-resolver.xml.
>
>FWIW, that's not how that's done in V3.

Disregard that, I didn't note that you were just resolving CN and then adding the nameid generation step later as intended. Not enough coffee in me yet.

>>In logs I see the following error.  What is wrong with the context?
>
>I believe that's probably a bug, some kind of error handling issue in conjunction with attribute consent being enabled. Please file it.

Thanks for filing. There are probably a few different issues in play here, attach the whole log to the bug when you get time. I think something else is misconfigured here that is really causing the problem, bug aside. It can't be resolving any attributes and I think for that to be the case your resolver config would have to be broken to start with.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net