NameID Format Generation

[Cantor, Scott]

> Also, this Attribute Definition is leftover from the v2 to v3 upgrade

>         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-
> format:WindowsDomainQualifiedName" />

That constant is wrong. That constant is NOT about SAML version. It is defined in SAML 1.x and that is the constant. The above is undefined. That is the root of your mess.

> (2) Modified the saml-nameid.xml to generate the format:

Pick the V2 way or the V3 way. If you use the V3 way, there is no attribute encoder involved.

>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> 
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-
> format:WindowsDomainQualifiedName"

Note you used the correct constant here.

> As an aside, why shouldn't the SAML2 encoding format be
> 
> p:format="urn:oasis:names:tc:SAML:2.0:nameid-
> format:WindowsDomainQualifiedName"

Because there is no such format in SAML.

> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-
> format:WindowsDomainQualifiedName</NameIDFormat>

And here you have the wrong constant, which doesn't match.

-- Scott