NameID generation based on email fails silently

[Thibault MARTIN]

Hi Steve,

My saml-nameid.xml contains of all the following.

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'uid'} }" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

    </util:list>

    <!-- SAML 1 NameIdentifier Generation -->
    <util:list id="shibboleth.SAML1NameIdentifierGenerators">

        <ref bean="shibboleth.SAML1TransientGenerator" />

                <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'uid'} }" />

        <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />
    </util:list>

Isn’t the string you mentioned only for SAML1? In my understanding SAML2 supports Nameid based on email too, did I get that wrong?

Thanks,

De : users <users-bounces at shibboleth.net> De la part de Mak, Steve
Envoyé : vendredi 25 septembre 2020 17:33
À : Shib Users <users at shibboleth.net>
Objet : Re: NameID generation based on email fails silently

The correct format for NameID 'emailAddress' is:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Not what you have in your saml-nameid xml.
This message contains confidential information. To know more, please click on the following link: http://disclaimer.bureauveritas.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200925/92c9b069/attachment.htm>