NameID Generation to SP

[Jay Mey]

Thank you Scott for the clarification so it seems emailAddress format is
the way to go (I have configured ADFS using email with my SP and it is
working). Let me work on configuring the NameID format to email address.
Any hints you can provide would be appreciated.

-Jay

On 3/24/16, 5:19 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>>On 3/24/16, 7:56 PM, "users on behalf of Jay Mey"
>><users-bounces at shibboleth.net on behalf of jmey at vmware.com> wrote:
>>
>>>Currently, I have enabled persistent NameID Generator and it seems to
>>>be doing the encoding properly as seen below in the idp-process.log.
>>>The end result of the mail attribute is a string like
>>>"9UoJLXa4TmaVDLUSk+7nh+9xUa4=³
>>> which is what is passed on to my SP as the username and email. The SP
>>>cannot read it in this format. Is this the correct result that should
>>>be expected?
>
>To explicitly answer that question though, yes, that's exactly what you
>should expect. A persistent ID is an opaque value specific to one SP that
>you have configured the IdP to generate via a salted hash over a source
>attribute, email in this case.
>
>If the SP cannot read it in that format, you've just established that it
>does not in fact support that format. And certainly not transient. What
>it really wants is "just give me an ID and stop forcing me to understand
>SAML", but if it wants an email address the emailAddress format is an
>appropriate choice to use.
>
>Of course, email address is a poor identifier also, but that's orthogonal
>to any SAML issues.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net