NameID generation based on email fails silently

[Thibault MARTIN]

Thanks a bunch Steve, that was simply it! I didn't allow that SP to access to the mail attribute!

Thank you all for your fast answers, this was incredibly helpful

-----Message d'origine-----
De : users <users-bounces at shibboleth.net> De la part de Mak, Steve
Envoyé : vendredi 25 septembre 2020 18:08
À : Shib Users <users at shibboleth.net>
Objet : Re: NameID generation based on email fails silently

NameID generation is fairly straightforward:

1. What does the SP prefer in SAML request by format? (I might have this priority order incorrect)
- If no pref (null or unspecified), is there a defined preference in relying party or the sp metadata?
2. What Generator defined in saml-nameid.xml fulfill #1 by exact format match?
3. Are the attributes I can use to fulfill #2 available to me in the authN context (id comes from resolver, availability comes from filter)?
- This is where you would need to make sure 'mail' is available and released to this service provider.

If your IdP is NOT building 'emailAddress' NameID, either 'mail' is not available as a source or the SAML request might be indicating a different preference, such as 'unspecified'.

- Steve

--
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!NslPjgbbnDqexg!ZGjDyS3zsjwGaDwG5wkyMk-LchFr76Za_v18ZvxEQp19jNhjzQEyTU0GQ69tKe_8a1uLYJo9eg$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
This message contains confidential information. To know more, please click on the following link: http://disclaimer.bureauveritas.com