Custom NameID in Shibboleth 2
Emily Heiner
eheiner at whatcom.edu
Fri Mar 1 13:47:22 EST 2019
I'm attempting to configure our Shib 2 IdP to send a custom NameID (in this case the email address). Adobe says they require the NameID to be an email address, and in my case it's currently sending something like this:
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://pass.whatcom.edu/idp/shibboleth"
SPNameQualifier="https://samltest.id/saml/sp">_902fb6940c3697b0e16ea4ea07b28fb4</saml2:NameID>
I've looked in the documentation and have come up with the following to do this:
attribute-resolver.xml:
<resolver:AttributeDefinition xsi:type="ad:Simple" id="SAMLTestNameId" sourceAttributeID="mail">
<resolver:Dependency ref="myLDAP" />
<resolver:Dependency ref="wccLDAP" />
<resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>
attribute-filter.xml:
<afp:AttributeRule attributeID="SAMLTestNameId">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
However, this doesn't change anything... Any help would be appreciated.
Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190301/059eab9d/attachment.html>
More information about the users
mailing list