About attribute setting to the NameID.

[Losen, Stephen C (scl)]

Hi Tomomi,

What you have done looks correct.

You can control the NameIDFormat per SP in relying-party.xml or if you manage the SP metadata, you can do it there like this:

<NameIDFormat> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

Put this immediately before the first <AssertionConsumerService> element. Remove any other <NameIDFormat> elements.

So basically you define the attribute "Email" in attribute-resolver.xml and then define the NameID format in saml-nameid.xml (which you have done). So now you need to define which NameIDFormat to pass to the SP, either in the SP metadata or relying-party.xml.  And you must release the "Email" attribute to the SP in attribute-filter.xml


Steve Losen
ITS - Enterprise Infrastructure
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Tomomi
Sent: Sunday, August 25, 2019 9:47 PM
To: users at shibboleth.net
Subject: About attribute setting to the NameID.

Hi

I have Shibboleth Idp ver 3.4.
Where do you set the attribute value of the name ID to be passed to SP?

I think below,

1. Pass the mail attribute to "Email" with the following settings.
attribute-resolver.xml

    <AttributeDefinition xsi:type="Simple" id="Email">
        <InputDataConnector ref="myLDAP" attributeNames="mail" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="Email"
encodeType="false" />
    </AttributeDefinition>

2. Pass "Email" to NameID with the following settings.

saml-nameid.xml

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:omitQualifiers="true"
           
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'Email'} }" />


Is it correct?

If correct, can I set different Name ID of the attribute value to each SP?

Please tell me some idea!

Regards,

Tomomi




--
Sent from: https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net