Help on unspecified nameID (IdP ver 3.2.x)

[Lalith Jayaweera]

Thanks Scott,

Just to clarify, what do you meant by 'You'd have to release uid to that
SP' ?
You meant pass urn value of uid as NameID format?

basically for this SP, SP only needs uid in subject (via NameID) with
format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

Does not require anything in attribute section....

or also do we have examples on how to configure the generator to achieve
it?

It looks like, needs to configure more things than listed below URL(section
on unspecified) to pass below format , any other reference will be helpful
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith


Thanks

On Fri, Apr 7, 2017 at 4:31 PM, Lalith Jayaweera <ljayaweera at gmail.com>
wrote:

> Hi,
>
> For some existing vendors I need to still support
>  urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified  unfortunately...
>
> during my migration to IdP 3.2.x I followed below doc to achieve above
> need but with no luck
>
> https://wiki.shibboleth.net/confluence/display/IDP30/CustomN
> ameIDGenerationConfiguration#CustomNameIDGenerationConfigura
> tion-Dealingwith
>
> Given no deny rules for transient ID like 2.x I did below in IdP 3.x,
> please let me know whether it is correct
>
> in the saml-nameid.xml
>
>  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>                  p:format="urn:oasis:names:tc:
> SAML:1.1:nameid-format:unspecified"
>               p:attributeSourceIds="#{ {'uid'} }">
>         <property name="activationCondition">
>         <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidates="#{{'https://mytestsp.com/samlLogin'}}" />
>         </property>
>        </bean>
>
>
> and in relying party .xml I got below
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="https://myt
> estsp.com/samlLogin">
>             <property name="profileConfigurations">
>                 <list>
>
>         <bean parent="SAML2.SSO" p:encryptAssertions="false"
> p:signAssertions="true" p:signResponses="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>  />
>
>                 </list>
>             </property>
>         </bean>
>
>
> but However in the SAML response I cannot see any NameID getting past from
> IdP, if I remove above p:nameIDFormatPrecedence, I can see the transientId
> getting passed for the NameID.
>
> Can you advice, do I have to do any other config change to achieve above
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170408/a61804ae/attachment.html>