Unencrypted NameID

[Cantor, Scott]

> I added the following to my attribute-filter.xml:

The default behavior of the attribute-sourced NameID generator is to rely on released attributes, so the attribute you need to "release" to the SP is the mail attribute. So what you're doing here isn't going to help. Whether that's your problem is a different issue, but it won't work until you fix that. Releasing "NameID" is meaningless. There is no such attribute.

You can also, if you prefer, configure the generator plugin to allow sourcing of "unfiltered" attributes so that you don't have to explicitly release the source attribute by setting the useUnfilteredAttributes property of the generator.

>     I suspect that the transientid is unecessary but a colleague suggested it
> based on what we got from our SP in the metadata which is below:

There is nothing in the filter policy that has any effect on transient identifiers, period.

>     I think I have everything in place but I'm still getting a transient string rather
> than the email address.  What am I missing?

Well, with no logs, I'm just guessing. You didn't release mail, so that isn't going to work, but even if you did, I don't think there's anything here that would suggest it will pick anything but transient, because the metadata is explicit about wanting that.

I've documented the NameID Format selection algorithm in as much detail as I know how to:

https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration

I think it should be quite clear from that that if the metadata requests transient, that's what you're getting.

We can have a discussion about whether that's the right thing to do, but that's what we do. If the metadata lists only transient, I don't believe there's *anything* you could do that would give you a different outcome. The most it would do is include nothing, if you blocked the support for transients. It would never include a Format that the SP doesn't support. If the metadata contains *nothing*, then the rest of the machinery takes over because that means there is no preference being expressed.

That metadata is simply wrong.

-- Scott