Custom NameID in Shibboleth 2

[Emily Heiner]

I got rid of the transient and persistent nameid formats from the metadata xml, leaving only emailAddress, and changed the attribute-resolver to use urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, and that works as well. Oddly, in the SAML output during the login process, it gets set to:
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">foo at bar.com</saml2:NameID>

I'll take hacking it into submission, as long as it works. We're going to be shifting to Shibboleth 3 or ADFS at some point relatively soon, so exploiting a bug for successful logins is fine by me for now.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, March 1, 2019 11:40 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Custom NameID in Shibboleth 2

On 3/1/19, 2:34 PM, "Emily Heiner" <eheiner at whatcom.edu> wrote:

> Thanks for the help. I ended up getting it to work, actually. Logs in to Adobe without issue now.

You're just hacking it into submission by mislabeling an encoder's Format as "transient" so that when it defaults to that it happens to pick what you wanted. That itself isn't something it would do predictably. And that's an invalid piece of SAML output. The fact that Adobe doesn't care is not a good thing, it's just a bug.

You don't need SAML 1 support here, and the SAML 2 encoder needs the emailAddress Format, not transient.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net