Change the ID in the Saml response

[IAM David Bantz]

Interpreting the quoted vendor's message to mean the vendor is consuming
nameID in the subject of your SAML assertion I would try this:

(1) Determine what value you can use or gin up for a nameID; might or might
not be a valid email address, but the value must be unique and should be
persistent and not reassigned.  You'll want to know if the service may send
email based on the nameID having email-like syntax, which complicates your
task of determining a unique persistent value that will also be valid
email. eduPersonUniqueId works at my institution because we route ePUID =
id#@alaska.edu to institutional email, but that depends on specific
institutional practices.

In IdP 2,

(2) define a custom attribute in attribute-resolver.xml with a source
attribute value you determined in (1), and an encoder that encodes the
attribute as a nameID with the required nameid-format [persistent?
emailAddress? - you'd better ask the service]; and

(3) release that attribute and exclude other nameIDs to the service in
attribute-filter.xml

David Bantz


On Fri, Mar 3, 2017 at 8:31 AM, Stephen Meier <stephencm at cos.edu> wrote:

> Good Morning,  I have shibboleth version 2.4.0
>
>
>
> I am trying to setup my ID to work with examsoft.  The gentleman who I am
> working with is getting the SAML response from our IDP below.
>
> array (
>
>   'Value' => 'L0Wz0mhqQUyPzp42n4fJ9w==',
>
>   'Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
>
>   'NameQualifier' => 'https://shib.cos.edu/idp/shibboleth',
>
> )
>
>
>
> He says that for his software to work, the ‘Value’ needs to be the email
> address.  I have been changing the attributes.xml, but I am thinking I need
> to change the ID of the SAML response.  I have no idea how to do that.
>
>
>
> Any direction would be helpful.
>
>
>
> Stephen
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170303/8abbef55/attachment.html>