AWS AppStream

[Hong Ye]

I tried configure IDP release urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress format nameID with relying party overwrite. But with nameID format requirements in  their metadata, no nameID was released.

<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{
            'urn:amazon:webservices'
            }}" >

            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence=" urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress " />
                    </list>
            </property>
</bean>

If I removed their nameID format requirements from it’s metadata,  then aws login works fine. The problem is AWS refresh their metadata every year. I tried to avoid manually modify their metadata .

Thanks,

Hong


On 8/4/17, 10:47 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    On 8/4/17, 10:41 AM, "users on behalf of Yavor Yanakiev" <users-bounces at shibboleth.net on behalf of yavor at nyu.edu> wrote:
    
    > According to AWS’s metadata(https://signin.aws.amazon.com/static/saml-metadata.xml), it requires nameID format:
    
    You should never believe or trust that information in someone's metadata. It is not meaningful unless you got it from a federation or created it yourself. People throw anything and everything into metadata by copying and pasting things with no understanding or care.
    
    -- Scott
    
    
    -- 
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net