NameID Format

[IAM David Bantz]

If both cnIdentifiedName and transientID are available encoded as NameID,
the IdP is "choosing" the latter.

You may need to adjust the attribute-filter.xml to not release transientID
to the SP for which you want the subject to be cnIdentifiedName.



On Wed, Sep 30, 2015 at 11:53 AM, Michael Dahlberg <olgamirth at gmail.com>
wrote:

> I thought I was getting an understanding of the NameID format and its
> encoding.  Unfortunately, I think I'm incorrect.
>
> I have the following configuration in the attribute-resolver.xml in a shib
> v. 2.4.0 IdP:
>
>  <resolver:AttributeDefinition id="cnIdentifiedName"
> xsi:type="ad:PrincipalName">
>         <resolver:Dependency ref="commonName" />
>         <resolver:AttributeEncoder
> xsi:type="enc:SAML1StringNameIdentifier"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" />
>     </resolver:AttributeDefinition>
>
>
> My reading of this is that when I release the attribute "cnIdentifiedName"
> that the "commonName" attribute retrieved from our LDAP server will be
> SAML2 encoded and released in the Subject NameID field.  Unfortunately,
> this is the Subject of the SAML trace when I do that:
>
> <saml2:Subject>
>             <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>                           NameQualifier="https://shib.bucknell.edu/idp/shibboleth"
>                           SPNameQualifier="benefitfocus.com:sp"
>                           >_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
>             <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
>                 <saml2:SubjectConfirmationData Address="172.20.10.105"
>                                                InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"
>                                                NotOnOrAfter="2015-09-30T19:35:21.055Z"
>                                                Recipient="https://testsp.benefitfocus.com/sp/ACS.saml2"
>                                                />
>             </saml2:SubjectConfirmation>
>         </saml2:Subject>
>
>
> It looks as if the NameID is encoding the transientID.  Any suggestions on how to correct this and release the commonName in an emailAddress format, SAML2 encoded, in the NameID?
>
>
> Thanks,
>
> Mike
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150930/806f936c/attachment-0001.html>