NameID Format

[Michael Dahlberg]

On Wed, Sep 30, 2015 at 4:07 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/30/15, 3:53 PM, "users on behalf of Michael Dahlberg" <
> users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:
>
> >My reading of this is that when I release the attribute
> "cnIdentifiedName" that the "commonName" attribute retrieved from our LDAP
> server will be SAML2 encoded and released in the Subject NameID field.
>
> If that Format is selected. If the SP doesn't tell it anything, the
> metadata doesn't tell it anything, and you don't tell it anything, then
> what gets selected is the same as always.
>



Yes, my apologies.  Of course, I am releasing that attribute in the
attribute-filter.xml file:

<afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="benefitfocus.com:sp" />

        <afp:AttributeRule attributeID="cnIdentifiedName">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

I should have specifically delineated that.  I release the
WindowsDomainQualifiedName in a similar fashion and the correct value gets
released.



>
> The selection process is documented [1]. I don't know why it's so
> confusing, you can probably help with that.
>
>
>
> [1] https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
> (bottom of page)
>
>

I appreciate your help with this.  Unfortunately, most of the Shibboleth
wiki pages are long on description and short on examples. I appreciate the
description of a persistent identifier but I don't know how it is used,
what it releases, or where it releases it in the SAML payload.  I usually
stop reading that particular page at that point.  I agree, I should
continue on.



> It's probably also worth noting that there is not an e-mailAddress
nameFormat unique to SAML 2.0, so your third line below should still
reference the 1.1 emailAddress name format type:

>       <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />


I'm not sure how I would know that there "is not an e-mailAddress
nameFormat unique to SAML 2.0" and what effect changing that nameFormat has
on what is released, how it is released and where it is released..

Given that I am releasing the cnIdentifiedName in the attribute-filter,
that other attributes can be released without blocking the transientID,
would there be any other reason why the transientID is released and not the
cnIdentifiedName?

Thanks again,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150930/17875786/attachment-0001.html>