SAManage with Shibboleth 3?

[Peter Schober]

* Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-04-16 15:47]:
> The docs I've been following are:
> https://community.samanage.com/message/6116
> and
> https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage

>From those two I gather that your question actually is:
How do I release the subject's email address as an emailAddress-format
NameID in Shibboleth IDPv3?

> relying-party.xml:
>      <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
>         <property name="profileConfigurations">
>             <list>
>               <bean parent="SAML2.SSO" p:encryptAssertions="never"
> p:signAssertions="always" p:encryptNameIDs="never"
> p:signResponses="always"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>             </list>
>         </property>
>     </bean>

FYI, you can drop p:nameIDFormatPrecedence from there and instead
simply add that format as the first (or only) NameIDFormat element to
the locally-managed SAML metadata you load from
%{idp.home}/metadata/samanage-metadata.xml

> attribute-resolver.xml:

No need to touch the resolver for IDPv3. Instead just add this to your
conf/saml-nameid.xml (and remove your previous attempts while you#re
there) to the util:list with id="shibboleth.SAML2NameIDGenerators":

  <!-- email as NameID -->
  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
      p:omitQualifiers="true"
      p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
      p:attributeSourceIds="#{ {'mail'} }" />

and release the 'mail' attribute to the SP in your
attribute-filter.xml, as usual.

Done.

-peter