Custom NameID in Shibboleth 2

[Emily Heiner]

Thanks for the help. I ended up getting it to work, actually. Logs in to Adobe without issue now.

I used the following in attribute-resolver.xml:
	<resolver:AttributeDefinition xsi:type="ad:Simple" id="AdobeNameId" sourceAttributeID="mail">
		<resolver:Dependency ref="myLDAP" />
		<resolver:Dependency ref="wccLDAP" />

		<resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
		xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
		nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
		 
		<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
		xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
		nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
	</resolver:AttributeDefinition>

and then releasing the attribute in attribute-filter.xml
		<afp:AttributeRule attributeID="AdobeNameId">
			<afp:PermitValueRule xsi:type="basic:ANY" />
		</afp:AttributeRule>

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, March 1, 2019 11:25 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Custom NameID in Shibboleth 2

On 3/1/19, 2:09 PM, "users on behalf of Emily Heiner" <users-bounces at shibboleth.net on behalf of eheiner at whatcom.edu> wrote:

> I work for a small community college. Our resources here are pretty limited.

That's why I didn't simply say you should upgrade. There are a lot of choices.
 
> As to requiring the NameID  to be the email address, Adobe's support site for the particular error I'm getting says:

I won't argue the point, I'm telling you what they actually support and what the best practice is. Email addresses are not identifiers, and unless yours are stable, you don't want to use them as identifiers. And you don't have to.

If you choose to do that, then yes, you would have to pass the address in the NameID. You are ignoring the Format selection aspect of using NameIDs. The IdP won't pick your preferred Format unless it's told to, it will default to transient. You also assigned *no* Format. Never use the "unspecified" constant. Ever. There is a standard constant in the spec for the emailAddress Format you should use.

But you still have to configure the use of that Format, and the easiest way to do that is to add a <md:NameIDFormat> element with the desired Format to the metadata for Adobe's SP to tell the IdP what it's supposed to use.

I won't say "read the documentation" because the V2 docs are lousy in this area.
 
-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net