NameID generation for email failed when format is not set explicit on SessionInitiator

[Patrick Brunmayr]

Note you can get email to be released as NameID without also releasing
is as a SAML Attribute, too, that's documented here ("useUnfilteredAttributes"):

I have done this here

<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
    </resolver:AttributeDefinition>


Btw, are you ever going to provide feedback about the answers people
in this forum have taken care to provide, to help you solve /your/
problems? I only see questions asked, answers being provided, and then
new questions being asked.
Did the provided answers help/solve your issue (you're welcome) and if
not what was the problem?

I am sorry for that i am new to this kind of communication. But i am very thankful for your.

BTW this information helped a lot.

Thx

Am 04.08.2016 um 10:38 schrieb Peter Schober:

* Patrick Brunmayr <p.brunmayr at linzag.at><mailto:p.brunmayr at linzag.at> [2016-08-04 10:00]:


I want to use the urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress NameIDFormat.

This is my idp configuration

idp-metadata.xml

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>



The IDP does not read its own metadata. You want to have that in the
(IDP's copy of) SP's metadata, that's what the IDP takes as input.

That's documented here:
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-FormatSelectionFormatSelection



<AttributeRule attributeID="mail">
           <PermitValueRule xsi:type="ANY" />
       </AttributeRule>



Note you can get email to be released as NameID without also releasing
is as a SAML Attribute, too, that's documented here ("useUnfilteredAttributes"):

https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-GeneralProcedure



2016-08-04 08:44:55,762 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- Metadata specifies the following formats: []



The SP doesn't tell the IDP what formats it wants in its SAML 2.0 Metadata.



2016-08-04 08:44:55,763 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
- Configuration specifies the following formats: []





2016-08-04 08:44:55,763 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:110]
- No formats specified in configuration or in metadata, returning
default



Those should be self-explanatory now.



2016-08-04 08:44:55,764 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
- Trying to generate identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:transient





2016-08-04 08:44:55,764 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] -
Profile Action AddNameIDToSubjects: Unable to generate a NameID,
leaving empty



No idea what you did there, transients are enabled and fully working
out of the box. There's nothing to change about them.



Does the idp always use the idp.nameid.saml2.default settings when
no samlp:NameIDPolicy is present ? Why does he not check the
supportted NameIDFormat elements in idp.metadata.xml. Who is
responsible for selecting the format ?



The URL at the top of this email should cover those.

Btw, are you ever going to provide feedback about the answers people
in this forum have taken care to provide, to help you solve /your/
problems? I only see questions asked, answers being provided, and then
new questions being asked.
Did the provided answers help/solve your issue (you're welcome) and if
not what was the problem?
-peter


--
Patrick Brunmayr
LINZ AG TELEKOM
Infrastruktur & Netzwerktechnik
Internet Services

Die LINZ AG TELEKOM ist ein Geschäftsbereich der LINZ STROM GmbH
für Energieerzeugung, -handel, -dienstleistungen und Telekommunikation.

4021 Linz,  Wiener Straße 151, Austria
Tel.:        +43(0)732/3400-5639
Fax:        +43(0)732/3400-155639
E-Mail:    p.brunmayr at linzag.at<mailto:p.brunmayr at linzag.at>
Internet:  www.linzag-telekom.at<http://www.linzag-telekom.at>

FN 199533 g des Landesgerichtes Linz
Zertifiziert nach:
EN ISO   9001 Qualitätsmanagement (QM)
OHSAS 18001 Arbeitsschutzmanagementsystem
ISO/IEC 27001 Informationssicherheits-Managementsystem (ISMS)




LINZ AG für Energie, Telekommunikation, Verkehr und Kommunale Dienste
A-4021 Linz, Wiener Straße 151, Postfach 1300, Tel. +43/732/3400-0, E-Mail: info at linzag.at


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160804/510b0d1b/attachment-0001.html>