NameID

[Hall, Gerry]

Notwithstanding Scott’s reply, I have often run into this with vendor apps requiring that the NameID field be populated with a specific user attribute in a specific format. Here is how I have handled this.  For the examples I will use uid.

Method #1:
1. Add the format in the saml-namedid.xml.
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ { 'uid'} }" />

2. Add the following in the relying-party.xml for the SP.
<bean id="PlatformBoomService" parent="RelyingPartyByName"
                    c:relyingPartyIds="#{{'https://platform.boomi.com/sso/training-EETWCP/saml’
                                          }}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
                            p:nameIDFormatPrecedence="#{{ ‘urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified '}}"
     p:encryptAssertions="false"
                       />
                </list>
            </property>
    </bean>

3. Reload the saml-nameid and relying-party services.

Method #2:
In all honesty, I just found this a few days ago, and I have not used this method, so see:  https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration

1. In saml-nameid.xml, add something like the following.
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:omitQualifiers="true"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'NameID'} }">

            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
                c:candidates="#{{'https://platform.boomi.com/sso/training-EETWCP/saml’}}" />
            </property>
        </bean>

2. Reload the saml-nameid service.


_______

On 6/18/18, 10:38 AM, "users on behalf of Hong Ye" <users-bounces at shibboleth.net on behalf of hy93 at cornell.edu> wrote:

    Thanks! That's what I thought, but Dell won't admit it is a bug on their end.

    Hong

    On 6/18/18, 10:36 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

        > But transientID is sent back in nameID field. Is there anyway to overwrite
        > transient format with unspecified format?

        Nope, the spec requires that the IdP do what it's doing, and they have a bug. They have to fix it, there is no rational workaround you should use.

        -- Scott

        --
        For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
        To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


    --
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).