v3.2 - unsupportable identifier -Name ID

[Ramaiah, Vanna G.]

I read the document but I am still missing something and getting invalid NameIdentified error. Below is my configuration.What am I missing?

1. In attribute-resolver,
 <resolver:AttributeDefinition id="EmailNameIdspecified" xsi:type="ad:Simple" sourceAttributeID="mail"> <resolver:Dependency ref="myAD" />
                <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />
                <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
        </resolver:AttributeDefinition>
2. In attribute-filter,
   <afp:AttributeFilterPolicy id="releaseToXYZ">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="XYZ"/>
        <afp:AttributeRule attributeID="EmailNameIdspecified"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
    </afp:AttributeFilterPolicy>
3.In metadata of xyz, 
  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
4. In saml-nameid.xml, I have
<util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />
        <ref bean="shibboleth.SAML2PersistentGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />
</util:list>
5. All lines are commented out in saml-nameid.properties


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 21, 2017 11:25 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: v3.2 - unsupportable identifier -Name ID



> 2017-02-21 11:08:32,722 - WARN
> [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatSt
> rategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified'
> format

Please just read the documentation on NameID format selection. I'm not going to repeat it here.

>  Other SP , after logging in, if I click a link, it's supposed to 
> display all attributes passed by Idp. It's not showing up. Both the 
> SP's both work fine in V2.4

Then you didn't accurately reproduce your relying party overrides in the new system (or your old system was not configured properly and was only working by accident) and you are not selecting the NameID Format to use via an override with a nameIDFormatPrecedence setting.

Or you can stop using unspecified. Pass a proper Format with the same value in it, and put that Format into the SP's metadata in a NameIDFormat element.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net