Config email address as principal

[Cantor, Scott]

> I’m fairly new to Shibboleth and SAML, so my apologies for the naive
> question.

First please review the CONCEPT space material on SAML Attributes and Name Identifiers [1]. There is no such thing as a "principal" or "username" on the wire. And you MUST NOT ever pass anything like a username as a NameID with a transient Format.

> I have a new SP I'm trying to
> configure which requires an email address instead of simply a username. The
> SP metadata file specifies:
> 
> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

If it doesn't know how to consume SAML Attributes to get the email address, then that's not correct metadata, but the next bit seems to suggest they can use attributes, if badly.

> <md:RequestedAttribute FriendlyName="email" isRequired="true"
> Name="User Id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-
> format:uri"/>

That's also nonsensical. If the Attribute is named by URI (the NameFormat there), then it can't have a name like "User Id" and you certainly don't put spaces inside attribute names, ever.

> No attribute of principal 'dcarter' can be encoded in to a NameIdentifier of
> required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for
> relying party 'foo.domain.com <http://foo.domain.com> '

You had to have changed defaults I think to make it do something that unusual.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/CONCEPT/Home