Not getting an attribute statement in IDP assertion

[Cantor, Scott]

On 10/27/15, 10:38 AM, "users on behalf of Taylor Centers" <users-bounces at shibboleth.net on behalf of taylor.centers at gmail.com> wrote:



>I'm trying to get my ldap database associated with the users in the salesforce account, but no identifying information is being sent up with the assertion.  The Subject, NameID is a random transient value, and I couldn't figure out how to make it a persistent
> hash of user data. I tried changing saml-nameid.xml and saml-nameid.properties with no results, the entire NameID block would disappear from the assertion if I tried changing it.

Well, I can't do more than point you at the documentation. If you have a specific question about any of what the documentation tells you to change, just ask.

But before I point at any docs, I have to know the use case. Are you absolutely certain you're needing to use a SAML persistent ID with Salesforce? I very much doubt that. I don't think you can in fact.

>Below is what I think the relevant files and fields for adding an attribute to the assertion, in my case the user's email.

A NameID and an Attribute are not the same. I don't know which Salesforce requires. My recollection is they allow for either, but I'm not sure.

>But I am seeing no effect.  The logs look like it is getting the 'mail' attribute or at least parses the configuration properly, but I the array for included attributes is empty.

No, it's not (as Tom noted). If you have logs indicating the assertion doesn't contain any Attributes, then the resolver is the problem. But that log is showing nothing, it's the startup log with no sign of actual use of the IdP yet.

-- Scott