NameID generation for email failed when format is not set explicit on SessionInitiator

[Peter Schober]

* Patrick Brunmayr <p.brunmayr at linzag.at> [2016-08-04 10:00]:
> I want to use the urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress NameIDFormat.
> 
> This is my idp configuration
> 
> idp-metadata.xml
> 
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

The IDP does not read its own metadata. You want to have that in the
(IDP's copy of) SP's metadata, that's what the IDP takes as input.

That's documented here:
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-FormatSelectionFormatSelection

> <AttributeRule attributeID="mail">
>            <PermitValueRule xsi:type="ANY" />
>        </AttributeRule>

Note you can get email to be released as NameID without also releasing
is as a SAML Attribute, too, that's documented here ("useUnfilteredAttributes"):

https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-GeneralProcedure

> 2016-08-04 08:44:55,762 - DEBUG
> [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
> - Metadata specifies the following formats: []

The SP doesn't tell the IDP what formats it wants in its SAML 2.0 Metadata.

> 2016-08-04 08:44:55,763 - DEBUG
> [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
> - Configuration specifies the following formats: []

> 2016-08-04 08:44:55,763 - DEBUG
> [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:110]
> - No formats specified in configuration or in metadata, returning
> default

Those should be self-explanatory now.

> 2016-08-04 08:44:55,764 - DEBUG
> [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
> - Trying to generate identifier with Format
> urn:oasis:names:tc:SAML:2.0:nameid-format:transient

> 2016-08-04 08:44:55,764 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] -
> Profile Action AddNameIDToSubjects: Unable to generate a NameID,
> leaving empty

No idea what you did there, transients are enabled and fully working
out of the box. There's nothing to change about them.

> Does the idp always use the idp.nameid.saml2.default settings when
> no samlp:NameIDPolicy is present ? Why does he not check the
> supportted NameIDFormat elements in idp.metadata.xml. Who is
> responsible for selecting the format ?

The URL at the top of this email should cover those.

Btw, are you ever going to provide feedback about the answers people
in this forum have taken care to provide, to help you solve /your/
problems? I only see questions asked, answers being provided, and then
new questions being asked.
Did the provided answers help/solve your issue (you're welcome) and if
not what was the problem?
-peter