NameID generation for email failed when format is not set explicit on SessionInitiator

[Patrick Brunmayr]

I'm certainly glad to hear that. Without that info there's no way of
knowing whether anything we do and say here has the intended effect,
or whether the answers themselfs are still unclear.

I apologize for missing feedback till now and i understand your issue with that. Its really awesome that there is a place to ask and get help. Thx

Am 04.08.2016 um 11:12 schrieb Peter Schober:

* Patrick Brunmayr <p.brunmayr at linzag.at><mailto:p.brunmayr at linzag.at> [2016-08-04 10:50]:


Note you can get email to be released as NameID without also releasing
is as a SAML Attribute, too, that's documented here ("useUnfilteredAttributes"):

I have done this here

<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
       <resolver:Dependency ref="myLDAP" />
       <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
       <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
   </resolver:AttributeDefinition>



No, the resolver has nothing to do with that. I said you don't have to
release mail as an attribute (in your attribute-filter.xml), too, if
you don't want to.
If so you could set the documented flag (from the URL I sent) to allow
the IDP to populate a NameID from an attribute (value) that's not
itself released as SAML Attribute element.

If that's still unclear forget I ever mentioned it. If you're sending
the email address in a NameID there's no damage done also sending it
redundantly in an Attribute.



Btw, are you ever going to provide feedback about the answers people
in this forum have taken care to provide, to help you solve /your/
problems? I only see questions asked, answers being provided, and then
new questions being asked.
Did the provided answers help/solve your issue (you're welcome) and if
not what was the problem?



I am sorry for that i am new to this kind of communication.



What, human communication? Saying "thanks, that worked" after someone
helped you solve a problem?



BTW this information helped a lot.



I'm certainly glad to hear that. Without that info there's no way of
knowing whether anything we do and say here has the intended effect,
or whether the answers themselfs are still unclear.
-peter


--
Patrick Brunmayr
LINZ AG TELEKOM
Infrastruktur & Netzwerktechnik
Internet Services

Die LINZ AG TELEKOM ist ein Geschäftsbereich der LINZ STROM GmbH
für Energieerzeugung, -handel, -dienstleistungen und Telekommunikation.

4021 Linz,  Wiener Straße 151, Austria
Tel.:        +43(0)732/3400-5639
Fax:        +43(0)732/3400-155639
E-Mail:    p.brunmayr at linzag.at<mailto:p.brunmayr at linzag.at>
Internet:  www.linzag-telekom.at<http://www.linzag-telekom.at>

FN 199533 g des Landesgerichtes Linz
Zertifiziert nach:
EN ISO   9001 Qualitätsmanagement (QM)
OHSAS 18001 Arbeitsschutzmanagementsystem
ISO/IEC 27001 Informationssicherheits-Managementsystem (ISMS)




LINZ AG für Energie, Telekommunikation, Verkehr und Kommunale Dienste
A-4021 Linz, Wiener Straße 151, Postfach 1300, Tel. +43/732/3400-0, E-Mail: info at linzag.at


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160804/e9d09a83/attachment.html>