Shibboleth IDP 3 and Onelogin PHP SAML library

[Richard Genthner]

Scott,
  That worked until I did this

    <afp:AttributeFilterPolicy id="wheniwork">
<PolicyRequirementRule xsi:type="Requester" value="
https://saml.wheniwork.com/682879" />
<AttributeRule attributeID="firstName">
<PermitValueRule xsi:type="basic:ANY" />
</AttributeRule>
<AttributeRule attributeID="lastName">
<PermitValueRule xsi:type="basic:ANY" />
</AttributeRule>
<AttributeRule attributeID="mail">
<PermitValueRule xsi:type="basic:ANY" />
</AttributeRule>
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="basic:ANY" />
</AttributeRule>
     </afp:AttributeFilterPolicy>


to set up the restriction. Now it seems that this brings back this error. I
did some digging around and tried adding this to the saml-nameid.xml file

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
   p:omitQualifiers="true"
   p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
   p:attributeSourceIds="#{ {'mail'} }">

   <property name="activationCondition">
       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="
https://saml.wheniwork.com/682879" />
   </property>
</bean>

but doesn't seem to fix the issue. Thoughts ????

On Wed, Jun 21, 2017 at 12:37 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/21/17, 12:23 PM, "users on behalf of Richard Genthner" <
> users-bounces at shibboleth.net on behalf of richard at guthnur.net> wrote:
>
> > Has anyone used Shibboleth IDP 3 and the onelogin PHP SAML Library? We
> are trying to get it working for requesting the email
> > attribute with the formatting of
> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress but i'm getting this
> in the logs:
>
> Then you didn't configure the IdP to support that Format. (*)
>
> See the docs under NameID Generation, subtopic on custom formats.
>
> -- Scott
>
> (*) Taken as given: never identify users by e-mail address, if you do need
> the address use the standards-defined "mail" attribute, and never use the
> NameID other than with the transient Format.
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/40c2c37d/attachment-0001.html>