NameID generation for email failed when format is not set explicit on SessionInitiator
Peter Schober
peter.schober at univie.ac.at
Thu Aug 4 05:12:06 EDT 2016
* Patrick Brunmayr <p.brunmayr at linzag.at> [2016-08-04 10:50]:
> Note you can get email to be released as NameID without also releasing
> is as a SAML Attribute, too, that's documented here ("useUnfilteredAttributes"):
>
> I have done this here
>
> <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
> <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
> </resolver:AttributeDefinition>
No, the resolver has nothing to do with that. I said you don't have to
release mail as an attribute (in your attribute-filter.xml), too, if
you don't want to.
If so you could set the documented flag (from the URL I sent) to allow
the IDP to populate a NameID from an attribute (value) that's not
itself released as SAML Attribute element.
If that's still unclear forget I ever mentioned it. If you're sending
the email address in a NameID there's no damage done also sending it
redundantly in an Attribute.
> > Btw, are you ever going to provide feedback about the answers people
> > in this forum have taken care to provide, to help you solve /your/
> > problems? I only see questions asked, answers being provided, and then
> > new questions being asked.
> > Did the provided answers help/solve your issue (you're welcome) and if
> > not what was the problem?
>
> I am sorry for that i am new to this kind of communication.
What, human communication? Saying "thanks, that worked" after someone
helped you solve a problem?
> BTW this information helped a lot.
I'm certainly glad to hear that. Without that info there's no way of
knowing whether anything we do and say here has the intended effect,
or whether the answers themselfs are still unclear.
-peter
More information about the users
mailing list