Custom NameID in Shibboleth 2

[Cantor, Scott]

On 3/1/19, 2:09 PM, "users on behalf of Emily Heiner" <users-bounces at shibboleth.net on behalf of eheiner at whatcom.edu> wrote:

> I work for a small community college. Our resources here are pretty limited.

That's why I didn't simply say you should upgrade. There are a lot of choices.
 
> As to requiring the NameID  to be the email address, Adobe's support site for the particular error I'm getting says:

I won't argue the point, I'm telling you what they actually support and what the best practice is. Email addresses are not identifiers, and unless yours are stable, you don't want to use them as identifiers. And you don't have to.

If you choose to do that, then yes, you would have to pass the address in the NameID. You are ignoring the Format selection aspect of using NameIDs. The IdP won't pick your preferred Format unless it's told to, it will default to transient. You also assigned *no* Format. Never use the "unspecified" constant. Ever. There is a standard constant in the spec for the emailAddress Format you should use.

But you still have to configure the use of that Format, and the easiest way to do that is to add a <md:NameIDFormat> element with the desired Format to the metadata for Adobe's SP to tell the IdP what it's supposed to use.

I won't say "read the documentation" because the V2 docs are lousy in this area.
 
-- Scott