NameID generation based on email fails silently

[Thibault MARTIN]

Aha interesting!

So the correct configuration shoud be the following?

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'uid'} }" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

    </util:list>

    <!-- SAML 1 NameIdentifier Generation -->
    <util:list id="shibboleth.SAML1NameIdentifierGenerators">

        <ref bean="shibboleth.SAML1TransientGenerator" />

                <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'uid'} }" />

        <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

I tried it, with which I'm not really more successful. I have the following in my logs/idp-warn.log at the time of the request

2020-09-25 17:55:13,092 - WARN [net.shibboleth.idp.profile.config.AbstractProfileConfiguration:283] - ProfileConfiguration http://shibboleth.net/ns/profiles/saml2/sso/browser: No ProfileRequestContext in request
2020-09-25 17:55:30,123 - WARN [net.shibboleth.idp.profile.config.AbstractProfileConfiguration:283] - ProfileConfiguration http://shibboleth.net/ns/profiles/saml2/sso/browser: No ProfileRequestContext in request

Thanks for your already helpful insights,

De : users <users-bounces at shibboleth.net> De la part de Cantor, Scott
Envoyé : vendredi 25 septembre 2020 17:46
À : Shib Users <users at shibboleth.net>
Objet : Re: NameID generation based on email fails silently

On 9/25/20, 11:39 AM, "users on behalf of Thibault MARTIN" <users-bounces at shibboleth.net on behalf of thibault.martin at bureauveritas.com> wrote:

>    Isn’t the string you mentioned only for SAML1? In my understanding
> SAML2 supports Nameid based on email too, did I get that wrong?

The version in the constants is the version of the standard that originally defined the value. SAML 2.0 did not replace formats that were already defined and usable, it only added new ones.

-- Scott


--
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!NslPjgbbnDqexg!cx02XCsx1h17F7kMQQN-hIbdROKelO68iH-a56CxRqQR4a1h8asPZghXqvtvUIamtC-5v2BXkg$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
This message contains confidential information. To know more, please click on the following link: http://disclaimer.bureauveritas.com