SAML2 NameID in Subject

[Andrew Morgan]

On Tue, 18 Jul 2017, Vonblohn, Kyle wrote:

> I am trying to setup adobe sso with IDPv3.  The documentation says they 
> need the NameID in the saml subject.  I can't seem to find any 
> documentation about where that is configured.  I've run a saml trace in 
> firefox and confirmed the entire NameID section is missing from the 
> subject.  If someone could point me in the right direction, I would be 
> appreciative.

Kyle,

Start with these:

   https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration

   https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration

Based on what I see with our Adobe integration, I think you'll need to 
support the "emailAddress" NameID Format.  We chose to release EPPN to 
SPs that request emailAddress.  In saml-nameid.xml, we have:

   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
       <property name="activationCondition">
           <bean parent="shibboleth.Conditions.NOT">
               <constructor-arg>
                   <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="google.com/a/oregonstate.edu" />
               </constructor-arg>
           </bean>
       </property>
   </bean>

This example also shows how we exclude our Google instance from this 
particular generator.

 	Andy