IdP 3 and Okta/Adobe SSO NameId

[James McCartin]

Thanks Peter.  I had to change the Adobe metadata to fix this.  I removed the others and added <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat> to the Adobe metadata.  I also had this p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", not p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:transient" in my final working configuration.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Tuesday, November 29, 2016 10:35 AM
To: users at shibboleth.net
Subject: Re: IdP 3 and Okta/Adobe SSO NameId

* James McCartin <jmccartin at loyola.edu> [2016-11-29 16:20]:
> Their documentation contains the following:
> 
> In addition to these custom attributes, you must configure the Subject 
> attribute's NameId field to contain the value of the user's login 
> username or e-mail
[...]
> The Adobe metadata has the following:
> 
> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent<
> /md:NameIDFormat> 
> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</
> md:NameIDFormat>

Well, that metadata should be corrected, then. If you're managing that locally put the SAML1.1 emailAddress one in there, and remove all others.

>         <ref bean="shibboleth.SAML2TransientGenerator" />
> 
>                                 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>                                                 p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:transient"
>                                                 
> p:attributeSourceIds="#{ {'mail'} }">
> 
>                                                 <property name="activationCondition">
>                                                                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
>                                                 </property>

That's not appropriate, putting email addresses into a "transient"
NameID (as clearly the email address is not a "transient" value), but also with this config and metadata I don't see how you could have gotten the message below:

> DEBUG
> [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStra
> tegy:100]
> - Configuration specifies the following formats:
> [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]

Nowhere in the metadata or your config above do I see this NameID format?

> What do I need to do to send the NameId as emailAddress.  I went 
> through the steps found here:
> https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGener
> ationConfiguration
> for a CustomNameID.

If you copied and pasted verbatim you would not have ended up with the config you posted above (transient format sourced from mail attribute). Compare with the "SAML 2.0 E-Mail Format Example" or "Example of a Generator for a specific SP" example on that very wiki page.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net