Anyone using Shibboleth with JAMF?

[Cantor, Scott]

> Finally my saml-nameid.properties still had these lines commented out:

That means you didn't upgrade, so it obviously didn't know you wanted the legacy feature on. That's why the instructions are to upgrade.

> idp.nameid.saml2.legacyGenerator =
> shibboleth.LegacySAML2NameIDGenerator
> idp.nameid.saml1.legacyGenerator =
> shibboleth.LegacySAML1NameIdentifierGenerator
> 
> Once I uncommented them it all burst into life. This is slightly
> confusing as I thought this was the non-legacy approach but hey-ho :)

The new wiring you added did not start working because you uncommented those. That would make the attribute resolver approach start working. You should be very careful you're not assuming you're relying on something you're not actually using.

-- Scott