Change the ID in the Saml response

[Stephen Meier]

Thanks for the information.  I will look into getting our IDP upgraded.



From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Friday, March 3, 2017 10:52 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Change the ID in the Saml response

Interpreting the quoted vendor's message to mean the vendor is consuming nameID in the subject of your SAML assertion I would try this:

(1) Determine what value you can use or gin up for a nameID; might or might not be a valid email address, but the value must be unique and should be persistent and not reassigned.  You'll want to know if the service may send email based on the nameID having email-like syntax, which complicates your task of determining a unique persistent value that will also be valid email. eduPersonUniqueId works at my institution because we route ePUID = id#@alaska.edu<http://alaska.edu> to institutional email, but that depends on specific institutional practices.

In IdP 2,

(2) define a custom attribute in attribute-resolver.xml with a source attribute value you determined in (1), and an encoder that encodes the attribute as a nameID with the required nameid-format [persistent? emailAddress? - you'd better ask the service]; and

(3) release that attribute and exclude other nameIDs to the service in attribute-filter.xml

David Bantz


On Fri, Mar 3, 2017 at 8:31 AM, Stephen Meier <stephencm at cos.edu<mailto:stephencm at cos.edu>> wrote:
Good Morning,  I have shibboleth version 2.4.0

I am trying to setup my ID to work with examsoft.  The gentleman who I am working with is getting the SAML response from our IDP below.

array (

  'Value' => 'L0Wz0mhqQUyPzp42n4fJ9w==',

  'Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',

  'NameQualifier' => 'https://shib.cos.edu/idp/shibboleth',

)

He says that for his software to work, the ‘Value’ needs to be the email address.  I have been changing the attributes.xml, but I am thinking I need to change the ID of the SAML response.  I have no idea how to do that.

Any direction would be helpful.

Stephen

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170306/86f2638d/attachment.html>