convert legacy NameID to current

[John C. Pfeifer]

My experience is that the vendor (through their metadata) is lying. They doesn’t care at all about the nameID format but only that it contains an email address.  I really, really, really hate this practice.


> On Aug 8, 2019, at 2:28 PM, sherrera <sherrera at bradley.edu> wrote:
> 
> We are still migrating away from our old version of shibboleth to version
> 3.4. We have 1 SP that that required this entry in attribute-resolver.xml
> for the legacy version:
> 
>    <resolver:AttributeDefinition xsi:type="ad:Simple" id="bitsightEmail"
> sourceAttributeID="mail">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>    </resolver:AttributeDefinition>
> 
> I do not want to use the backward compatibility options since that will be
> going away. I've not been successful with my saml-nameid.xml configuration
> either. 
> 
> The default value in saml-nameid.xml looks similar to what I need for the
> format. But when I try to release mail in attribute-filter.xml only my other
> attributes get released and mail is ignored. How do I release this?:
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>      p:omitQualifiers="true"
>      p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>      p:attributeSourceIds="#{ {'mail'} }" />
> 
> idp-process.log - WARN
> [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile
> Action AddNameIDToSubjects: Request specified use of an unsupportable
> identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
> 2019-08-08 13:07:54,142 - WARN
> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
> occurred while processing the request: InvalidNameIDPolicy
> 
> I've been reading through the documentation for generating the nameid and
> followed the example for Generator for a specific SP example where I specify
> the candidate url.
> 
> If I could follow an example of what someone else is doing, that would be a
> tremendous help. Thank you
> 
> 
> 
> --
> Sent from: https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


//
John Pfeifer
Division of Information Technology
University of Maryland, College Park