Help on unspecified nameID (IdP ver 3.2.x)

[Lalith Jayaweera]

Thanks Scott...

I tried both but did not work (basically no section visible in SAML
response for 'NameID' in subject)

basically below is what I did, in addition, uid is defined in resolver and
will certainly have a value part of resolution.

In saml-nameid.xml

.......
.......

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />
        <!-- Uncommenting this bean requires configuration in
saml-nameid.properties. -->
        <ref bean="shibboleth.SAML2PersistentGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
         p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
         p:useUnfilteredAttributes="%{idp.persistentId.
useUnfilteredAttributes:true}"
         p:attributeSourceIds="#{ {'uid'} }">
        <property name="activationCondition">
        <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#'
https://mysamplesitesp.com'}}" />
        </property>
       </bean>

..........

and in replyingparty.xml

  <util:list id="shibboleth.RelyingPartyOverrides">


<bean parent="RelyingPartyByName" c:relyingPartyIds="
https://mysamplesitesp.com">
            <property name="profileConfigurations">
                <list>
        <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/>
                </list>
            </property>
        </bean>
    </util:list>



basically need is to see similar  below.NameID section in response... but
not successful so far basically I see no NameID section at all for above
config.

 <saml2:Subject>
            <saml2:NameID
Format="*urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified*"
                          NameQualifier="https://myidp.x.x/idp/shibboleth"
                          >*5054433444*</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="10.48.1.45"

InResponseTo="samlrequest_7e3b387729854d408fa10de622889738"

NotOnOrAfter="2017-04-10T04:30:30.777Z"

Recipient="https://x.y./sample/login/"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>



Let me know where exactly the missing config required.

On Mon, Apr 10, 2017 at 2:28 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/7/17, 10:17 PM, "users on behalf of Lalith Jayaweera" <
> users-bounces at shibboleth.net on behalf of ljayaweera at gmail.com> wrote:
>
> > Just to clarify, what do you meant by 'You'd have to release uid to that
> SP' ?
>
> Release the uid attribute to the SP.
>
> > Does not require anything in attribute section....
>
> Then you'll have to change the generator as the documentation mentions to
> pull from the unfiltered attribute set.
>
> > or also do we have examples on how to configure the generator to achieve
> it?
>
> "The process above requires that you explicitly release the attribute to
> use as a source in your filter policy. If you wish, you can avoid this step
> by using a generator property (useUnfilteredAttributes) that allows an
> unreleased attribute to be used as a source, but note that doing so creates
> a sort of "pseudo-policy" exposing information to an SP outside of the
> normal filtering process."
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170410/0c2cd6c4/attachment.html>