NameID Format

[Krug, Jeff]

At a minimum you will need to update your attribute-filter as well, otherwise Shibboleth will continue to use a name identifier for which there is a release policy.  That may be the step you are missing.


See the very last part of the wiki page on custom name identifiers:


https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier


It's probably also worth noting that there is not an e-mailAddress nameFormat unique to SAML 2.0, so your third line below should still reference the 1.1 emailAddress name format type:


       <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />




________________________________
From: users <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Wednesday, September 30, 2015 3:53 PM
To: Shib Users
Subject: NameID Format

I thought I was getting an understanding of the NameID format and its encoding.  Unfortunately, I think I'm incorrect.

I have the following configuration in the attribute-resolver.xml in a shib v. 2.4.0 IdP:

 <resolver:AttributeDefinition id="cnIdentifiedName" xsi:type="ad:PrincipalName">
        <resolver:Dependency ref="commonName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>


My reading of this is that when I release the attribute "cnIdentifiedName" that the "commonName" attribute retrieved from our LDAP server will be SAML2 encoded and released in the Subject NameID field.  Unfortunately, this is the Subject of the SAML trace when I do that:


<saml2:Subject>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                          NameQualifier="https://shib.bucknell.edu/idp/shibboleth"
                          SPNameQualifier="benefitfocus.com:sp"
                          >_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.20.10.105"
                                               InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"
                                               NotOnOrAfter="2015-09-30T19:35:21.055Z"
                                               Recipient="https://testsp.benefitfocus.com/sp/ACS.saml2"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>


It looks as if the NameID is encoding the transientID.  Any suggestions on how to correct this and release the commonName in an emailAddress format, SAML2 encoded, in the NameID?


Thanks,

Mike

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150930/3007f8a6/attachment.html>