NameID generation based on email fails silently

[Thibault MARTIN]

Hello Shibboleth users,

I'm using a Shibboleth 3.3.1 IdP, and I'm having a hard time configuring for one SP in particular. I am unable to have a proper NameID based on email in the SAML Responses.

My IdP fetches information in a LDAP, using a DataConnector of LDAPDirectory type, defined in my conf/attribute-resolver.xml
Along with it are defined attributes in an AttributeResolver to map which attributes to fetch in the LDAP.

Those seem to work well for all the SP configured so far.

In my conf/attribute-filter.xml I also set up one AttributeFilterPolicyGroup with several AttributeFilterPolicy inside (one per SP).
The one I configured for the SP in question is as follows:
    <AttributeFilterPolicy id="Redacted">
        <PolicyRequirementRule xsi:type="Requester" value="Redacted" />
            <AttributeRule attributeID="givenName">
                <PermitValueRule xsi:type="ANY"/>
            </AttributeRule>

            <AttributeRule attributeID="surname">
                <PermitValueRule xsi:type="ANY"/>
            </AttributeRule>
    </AttributeFilterPolicy>

This FilterPolicy is the same as used elsewhere.

I declare my SP in conf/relying-party.xml in the following bean
    <bean id="internal-external" parent="RelyingPartyByName" c:relyingPartyIds="#{{'Redacted'}}">
        <property name="profileConfigurations">
            <list>
                <bean id="expiring-password" parent="SAML2.SSO" p:signAssertions="true" p:encryptAssertions="false" p:postAuthenticationFlows="ad-reconciliation,expiring-password" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
            </list>
        </property>
    </bean>

This seems to indicated I expect a NameID based on the emailAddress in my SAML Response.

I also have the following in my conf/saml-nameid.xml to configure where the email should be fetched to generate the NameID
    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'uid'} }" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

Yet, when I'm trying to authenticate to this SP I can't find a Nameid in my response. Am I missing something?
Is this something that has been fixed in newer versions?

Best,
This message contains confidential information. To know more, please click on the following link: http://disclaimer.bureauveritas.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200925/5104ab8f/attachment.htm>