delegation in IDP3

[Brent Putman]

On 8/10/16 5:22 PM, Cantor, Scott wrote:
>
> It won't do that for you unless you tell it to support emailAddress format.
>
> https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration
>
> If you did that, 

For the record, in my testing I did do that, and it worked for me. 
Part of my conf/c14n/subject-c14n.xml looks like the following.  I
added the 'urn:test:netid' format to support direct transform of that
(made up) format, as well as the entityIDs to the list in the predicate
to allow its use for them.


    <!-- What SAML NameID formats do you want to support direct
transformations for? -->
    <util:list id="shibboleth.NameTransformFormats">
       
<value>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</value>
       
<value>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</value>
       
<value>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</value>
       
<value>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</value>
        <value>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</value>
        <value>urn:test:netid</value>
    </util:list>

    <!--
    Under what conditions should direct NameID mapping be allowed? By
default, never.
    Any condition can be used here; the example is suitable for
enumerating a number of SPs to allow.
    -->
    <bean id="shibboleth.NameTransformPredicate"
parent="shibboleth.Conditions.RelyingPartyId">
        <constructor-arg>
            <util:list>
                <!-- <value>https://sp.example.org</value> -->
                <value>https://sp.example.org/shibboleth</value>
                <value>https://portal.example.edu/shibboleth</value>
                <value>https://service.example.com/shibboleth</value>
            </util:list>
        </constructor-arg>
    </bean>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160810/c2bd54df/attachment.html>