v3.2 - unsupportable identifier -Name ID

[Ramaiah, Vanna G.]

That worked like a charm. I am having problems with unspecified format. 
1. In attribute-resolver,
 <resolver:AttributeDefinition id="UnspecifiedNameId" xsi:type="ad:Simple" sourceAttributeID="mail"> <resolver:Dependency ref="myAD" />
                <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />
                <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
        </resolver:AttributeDefinition>

2. In attribute-filter,
   <afp:AttributeFilterPolicy id="releaseToXYZ">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="XYZ"/>
        <afp:AttributeRule attributeID="UnspecifiedNameId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

3.In metadata of xyz, 
  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

4. I copy pasted the relying-party.xml from V2.4 to V3.2. where should the below segment go?
 <bean parent="RelyingPartyByName"
              c:relyingPartyIds="#{{'XYZ'}}">
           
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.custom" p:signAssertions="true" p:encryptAssertions="false"  p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
                </list>
            </property>
        </bean>
    
5. Should I add anything to saml-nameid.xml?

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 21, 2017 7:58 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: v3.2 - unsupportable identifier -Name ID



On 2/21/17, 7:38 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 2/21/17, 6:20 PM, "users on behalf of Ramaiah, Vanna G." 
> users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:

>> I read the document but I am still missing something and getting 
>> invalid NameIdentified error. Below is my>
> configuration.What am I missing?
>
>David is correct, it should not have successfully loaded that 
>configuration, so that renders everything else you posted  suspect.

(But aside from that not possibly loading, if the persistent generator <ref> were appropriately commented out, everything else you posted would imply that the IdP would select the email Format for that SP and would generate the appropriate result, and there's no IdP error I would expect from it, nor did you post any.)

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net