Google Apps - Invalid Email

[Cantor, Scott]

On 10/28/15, 1:28 PM, "users on behalf of Muzinich, Mike" <users-bounces at shibboleth.net on behalf of MuziniM at losrios.edu> wrote:



>I am sure I am missing something simple but I am having a problem with Google not recognizing the email address attribute I am setting and releasing.

Google doesn't use attributes. It's a broken service in a number of regards and relies on the NameID.

>  This is for the upgrade to IDP 3.1.2.  I did not retain the existing Shibboleth configuration, I modified the native 3.1.2 config files.

You are however still using the legacy NameID generation approach using the resolver.

>  The correct email address shows up when I am prompted by Shibb to share the information with Google

Those are attributes. The release page doesn't know anything about NameIDs. Unfortunate limitation  that would probably get addressed down the road if we see actual evidence people are using the consent code much at all.

> and there are no errors in the logs.  It also tests successfully with TestShib.  This is the applicable attribute resolver and filter configurations.

You can't make this work without forcing the NameID format selection process to choose the "unspecified" format, and the only way to do that is via a relying party override and the nameIDFormatPrecedence property.

Or you can use the new docs on custom NameID generation and follow those, but you'll still have to force the format selection in the same way.

-- Scott