NameID

[Hong Ye]

Hello,

We had an issue with nameID when integrating Dell Boomi with Cornell IDP(v 3.3.2). Our IDP needs to put user’s netID in NameID field.

Their metadata specified two nameID formats:



<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

But in the authnRequest that Boomi sent, it specified
<saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />

On IDP side, we defined relying party overwrite

 <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{

            'https://platform.boomi.com/sso/training-EETWCP/saml'

             }}" >



            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.SSO"  p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"  />

                </list>

            </property>

 </bean>

But transientID is sent back in nameID field. Is there anyway to overwrite transient format with unspecified format?

Thanks,
Hong


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180618/55bb0ae3/attachment.html>