IdP 3 and Okta/Adobe SSO NameId

[Peter Schober]

* James McCartin <jmccartin at loyola.edu> [2016-11-29 16:20]:
> Their documentation contains the following:
> 
> In addition to these custom attributes, you must configure the
> Subject attribute's NameId field to contain the value of the user's
> login username or e-mail
[...]
> The Adobe metadata has the following:
> 
> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

Well, that metadata should be corrected, then. If you're managing that
locally put the SAML1.1 emailAddress one in there, and remove all
others.

>         <ref bean="shibboleth.SAML2TransientGenerator" />
> 
>                                 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>                                                 p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:transient"
>                                                 p:attributeSourceIds="#{ {'mail'} }">
> 
>                                                 <property name="activationCondition">
>                                                                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
>                                                 </property>

That's not appropriate, putting email addresses into a "transient"
NameID (as clearly the email address is not a "transient" value), but
also with this config and metadata I don't see how you could have
gotten the message below:

> DEBUG
> [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
> - Configuration specifies the following formats:
> [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]

Nowhere in the metadata or your config above do I see this NameID
format?

> What do I need to do to send the NameId as emailAddress.  I went
> through the steps found here:
> https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration
> for a CustomNameID.

If you copied and pasted verbatim you would not have ended up with the
config you posted above (transient format sourced from mail
attribute). Compare with the "SAML 2.0 E-Mail Format Example" or
"Example of a Generator for a specific SP" example on that
very wiki page.
-peter