NameID Format

[Michael Dahlberg]

I thought I was getting an understanding of the NameID format and its
encoding.  Unfortunately, I think I'm incorrect.

I have the following configuration in the attribute-resolver.xml in a shib
v. 2.4.0 IdP:

 <resolver:AttributeDefinition id="cnIdentifiedName"
xsi:type="ad:PrincipalName">
        <resolver:Dependency ref="commonName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>


My reading of this is that when I release the attribute "cnIdentifiedName"
that the "commonName" attribute retrieved from our LDAP server will be
SAML2 encoded and released in the Subject NameID field.  Unfortunately,
this is the Subject of the SAML trace when I do that:

<saml2:Subject>
            <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

NameQualifier="https://shib.bucknell.edu/idp/shibboleth"
                          SPNameQualifier="benefitfocus.com:sp"
                          >_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.20.10.105"

InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"

NotOnOrAfter="2015-09-30T19:35:21.055Z"

Recipient="https://testsp.benefitfocus.com/sp/ACS.saml2"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>


It looks as if the NameID is encoding the transientID.  Any
suggestions on how to correct this and release the commonName in an
emailAddress format, SAML2 encoded, in the NameID?


Thanks,

Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150930/8a1e557c/attachment.html>