Release NameID as UID

[Cantor, Scott]

On 9/16/15, 1:47 AM, "users on behalf of Johan Åkerstrøm" <users-bounces at shibboleth.net on behalf of Johan.Akerstrom at skill.no> wrote:


>
>What I actually need is urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, but I am stuck and getting confused now so I just posted what was my last try of very many tries.

Randomly trying things is the worst possible thing you can do. This software will react very badly to that. If you don't know what something does, just ask.

If you *need* to use the "unspecified" format, then:

- that's the format you need to generate in the custom NameID generator that is based on your source attribute

- you can't use the SP's metadata to "trigger" the selection of that format. You have to trigger it by putting that format string into a profile config bean's p:nameIDFormatPrecedence property in relying-party.xml

Other than that, it's a standard process.

>Well this is the rest of the log immediately after the error:

That's not the cause, that's the result. You're overlooking the Spring errors that have already been logged when the IdP starts up. If you prefer for that to be fatal, just set the failFast setting for that service in services.properties so you don't get a partially running IdP. As it is, you need to look at the logs to see why the file isn't loading.

I also urge you stop using DEBUG for logging. That's going to confuse you. You can use DEBUG if you can't get the information you need on INFO, but until that's actually the case, it's just noise.

>>I don't think that's the entire configuration, but you created an error in it somewhere.
>
>No, this is it:

Well, it doesn't look obviously wrong, other than that you've removed lots of things you shouldn't have. That may or may not be the problem, but either way, start over. You will break lots of other things by removing built-in features.

But I can't always eyeball it and just spot an XML error if it's not popping out at me.

>So basically I need to grab the original file from the dist?

I would, yes. It's already pre-installed for you in a dist/ subdirectory I believe.

-- Scott