Help on unspecified nameID (IdP ver 3.2.x)

[Lalith Jayaweera]

Hi,

For some existing vendors I need to still support
 urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified  unfortunately...

during my migration to IdP 3.2.x I followed below doc to achieve above need
but with no luck

https://wiki.shibboleth.net/confluence/display/IDP30/
CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfigur
ation-Dealingwith

Given no deny rules for transient ID like 2.x I did below in IdP 3.x,
please let me know whether it is correct

in the saml-nameid.xml

 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

              p:attributeSourceIds="#{ {'uid'} }">
        <property name="activationCondition">
        <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{{'https://mytestsp.com/samlLogin'}}" />
        </property>
       </bean>


and in relying party .xml I got below

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://
mytestsp.com/samlLogin">
            <property name="profileConfigurations">
                <list>

        <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
 />

                </list>
            </property>
        </bean>


but However in the SAML response I cannot see any NameID getting past from
IdP, if I remove above p:nameIDFormatPrecedence, I can see the transientId
getting passed for the NameID.

Can you advice, do I have to do any other config change to achieve above
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170407/9203b8d9/attachment.html>