Custom NameID in Shibboleth 2

[Emily Heiner]

I work for a small community college. Our resources here are pretty limited. I'm aware it's EOL, and we have plans to upgrade to Shib 3 this year, but we are on a time crunch to get this done with Shib 2 because of Adobe's requirements.

As to requiring the NameID  to be the email address, Adobe's support site for the particular error I'm getting says:

Validate that the proper SAML assertion is being sent:
* Validate that the identity provider passes the following attributes (case-sensitive) in the SAML assertion: FirstName, LastName, Email. If these attributes are not configured in the IdP to be sent over as part of the SAML 2.0 Connector configurati*on, the authentication will not work.
* Not having a NameID element in the subject. Validate that the Subject element contains a NameId element. It must be equal to the Email attribute, which should be the email address of the user that you want to authenticate.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, March 1, 2019 10:52 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Custom NameID in Shibboleth 2

On 3/1/19, 1:47 PM, "users on behalf of Emily Heiner" <users-bounces at shibboleth.net on behalf of eheiner at whatcom.edu> wrote:

> I’m attempting to configure our Shib 2 IdP

Shibboleth 2 has been EOL for years. You need to be moving to something else. If you can't upgrade, then you shouldn't use Shibboleth, you should find something you can maintain, or look at oursourcing.
 
> Adobe says they require the NameID to be an email address

They do NOT require that. And you don't want that, unless your email addresses are extremely stable. Set a Federation ID in the user records in Adobe's system, and then you can send any appropriate Format of NameID you choose that matches the Federation ID value.

-- Scott



-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net