NameID Format

[Cantor, Scott]

On 10/1/15, 12:07 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:

>    <resolver:AttributeDefinition id="userEmail" xsi:type="ad:PrincipalName" sourceAttributeID="mail" >

I'm pretty sure you can't use sourceAttributeID with that plugin, it's whole purpose is to source from the principal name. I thnk you want ad:Simple if you want a separate attribute definition sourced from mail.

Of course it would probably still work if your usernames were email addresses, but it wouldn't otherwise.

>And I am releasing the attribute in the attribute-filter file:
>
>
>    <afp:AttributeFilterPolicy>
>        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="benefitfocus.com:sp" />

Looks fine, assuming that invalid entityID is what they're using. It will work, but isn't legal though.


>My problem is that the NameID thats being returned to the SP is "dahlberg" when it should be "dahlberg at bucknell.edu":

That's for the reason above, wrong attribute definition plugin type.

-- Scott