Config email address as principal

[Doug Carter]

Hi All,

I’m fairly new to Shibboleth and SAML, so my apologies for the naive
question.

I’m running Shibboleth IDP 2.4.3 on CentOS 5, Tomcat 5, Java 1.6.  I've
setup access for several SPs using many of the defaults, using the
principal for logging in, which is our "username" (uid). I have a new SP
I'm trying to configure which requires an email address instead of simply a
username. The SP metadata file specifies:

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

and

<md:RequestedAttribute FriendlyName="email" isRequired="true" Name="User
Id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>

Not surprisingly when I attempt to access the SP with only a username, it
fails to login, and generates this message in the logs:

No attribute of principal 'dcarter' can be encoded in to a NameIdentifier
of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
for relying party 'foo.domain.com'

I've looked through the docs and Googled this a lot, and have seen others
with a similar problem, but it's not clear to me what part of the config
needs to be changed. I could pull the email address from LDAP, but since
our usernames are unique, I don't know why just hard-coding our domain to
the username wouldn't work. This seems like a pretty common config that
must come up, but so far I haven't found any good config examples that
shows how it's done.

Any tips, pointers or other advice would be greatly appreciated.

TIA,

Doug
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160906/0323d2a7/attachment.html>