IdP 3 and Okta/Adobe SSO NameId

[James McCartin]

I'm running into an issue trying to get my IdP integrated with Okta/Adobe.

Their documentation contains the following:

In addition to these custom attributes, you must configure the Subject attribute's NameId field to contain the value of the user's login username or e-mail (as configured in the Adobe Enterprise Dashboard). If you use Shibboleth as your IdP, see their documentation for configuring the NameIdfield

The Adobe metadata has the following:

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

I made the following changes:

saml-nameid.xml file:

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:transient"
                                                p:attributeSourceIds="#{ {'mail'} }">

                                                <property name="activationCondition">
                                                                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
                                                </property>
                                </bean>

    </util:list>

relying-party.xml file:

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:transient"
                                p:attributeSourceIds="#{ {'mail'} }">

                                <property name="activationCondition">
                                                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
                                </property>
</bean>

In my idp-process.log I have the following:

DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]
DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:121] - Filtered non-metadata-supported formats from configured formats, leaving: []

Adobe Event Logs shows the following error:

Inbound SAML login failed with message: The SAML response does not have NameId in the assertion

What do I need to do to send the NameId as emailAddress.  I went through the steps found here: https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration for a CustomNameID.

Thanks,

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161129/09a91b56/attachment-0001.html>