Custom NameID Generation

[Cantor, Scott]

> Oh, that's my mistake.  I thought that the attribute 'mail' was used to
> populate 'emailAddress' and that then 'emailAddress' should then be
> released.

There is no attribute called emailAddress in your configuration. Attribute release operates only on attributes.

> So you're saying that 'emailAddress' is a type of format and that 'mail' should
> be released?

emailAddress is nothing, it doesn't exist. The NameID Format "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" is just that, literally that format. There is no short form or abbreviation or truncation to "emailAddress" in any part of the system.

Whether you choose to release mail is optional, but is the normal assumption. By default, the generator operates only on released attributes since there's assumed to be a privacy component to custom IDs. If you want it to populate itself from unreleased attributes to skip that rule, you can do that by setting a property on it.

> 2016-03-04 14:44:08,948 - DEBUG
> [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile
> Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty
> 
> And no NameID in the Subject.  Either conceptually I'm missing something or
> I skipped some step.

Based on the log, what you posted as the saml-nameid.xml content can't be in use, or there's an extraneous typo causing a constant mismatch somewhere, otherwise it would work.

-- Scott