Need To Release emailAddress as NameID on Shib2 IDP

Tue Aug 30 16:57:59 EDT 2016

Don't these log entries show that all is well on our end?

15:43:47.268 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:868] - [a5a1ec2eb3a6f36f27a707614b412bece69899cc31258aac96649b9a2610253e] - [128.248.5.55] -  Using attribute 'emailAddress' supporting NameID format 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' to create the NameID for relying party 'https://login.citrixonline.com/saml/sp'
...
15:43:47.354 - INFO [Shibboleth-Audit:1028] - [a5a1ec2eb3a6f36f27a707614b412bece69899cc31258aac96649b9a2610253e] - [128.248.5.55] -  20160830T204347Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|a45h406i7a14g5c486h1a8di830d63|https://login.citrixonline.com/saml/sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibboleth.uic.edu/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e9ee7219ac913c12c27479cd9c028303|rullfig|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||rullfig@uic.edu|_5d3b98133ca7420275c02e52bb8c36a9,|

The rullfig at uic.edu listed at the end there is the nameid right?

---
Roberto Ullfig – rullfig at uic.edu
ACCC Research Programmer

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, August 30, 2016 3:48 PM
To: Shib Users
Subject: Re: Need To Release emailAddress as NameID on Shib2 IDP

On 8/30/16, 1:32 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

>    Remote SP (Citrix Online) is requiring this:    
>    
> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameidformat:emailAddress
> </md:NameIDFormat> (btw is this a new format or old? We’ve never seen 
> this before.)

That's been a standard format in SAML since SAML 1.1 (as you can guess from the URI).

>    And released it to the SP in filters. What else would I need to do? 
> Since this is a NameID it needs some extra configuration right? Thanks!

NameID Format selection:

- requested by SP via NameIDPolicy in its AuthnRequest
- specified in SP's metadata via NameIDFormat element
- set in relying-party override via nameIDFormatPrecedence property

That's it.

Same in V3.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net