NameID generation based on email fails silently
Mak, Steve
makst at upenn.edu
Fri Sep 25 16:07:51 UTC 2020
NameID generation is fairly straightforward:
1. What does the SP prefer in SAML request by format? (I might have this priority order incorrect)
- If no pref (null or unspecified), is there a defined preference in relying party or the sp metadata?
2. What Generator defined in saml-nameid.xml fulfill #1 by exact format match?
3. Are the attributes I can use to fulfill #2 available to me in the authN context (id comes from resolver, availability comes from filter)?
- This is where you would need to make sure 'mail' is available and released to this service provider.
If your IdP is NOT building 'emailAddress' NameID, either 'mail' is not available as a source or the SAML request might be indicating a different preference, such as 'unspecified'.
- Steve
More information about the users
mailing list