SAML2 NameID in Subject

[Vonblohn, Kyle]

For the record Scott, everything I posted and stated was true.  Here was the problem:

>From adobe's documentation located here: https://helpx.adobe.com/enterprise/kb/configure_shibboleth_idp_for_use_with_Adobe_SSO.html

The format of the nameid should be set to "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", however, in their metadata they only specified 

</md:KeyDescriptor>
  <md:NameIDFormat>
    urn:oasis:names:tc:SAML:2.0:nameid-format:persistent <----
  </md:NameIDFormat>
  <md:NameIDFormat>
    urn:oasis:names:tc:SAML:2.0:nameid-format:transient <-----
  </md:NameIDFormat>
  <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"


Once I changed the generator in saml-nameid.xml to match, everything began working.  Their documentation is incorrect.

Thanks for the help.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, July 18, 2017 9:37 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SAML2 NameID in Subject

On 7/18/17, 3:17 PM, "users on behalf of Vonblohn, Kyle" <users-bounces at shibboleth.net on behalf of kvonbloh at bloomu.edu> wrote:

> Yes, all 3 of their attributes are being released in the filter.

Then you need to use your logs I guess. Something you posted or have stated isn't true or it would be working. You also don't need an activation condition on that generator.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net