NameID Format/Policy help

[Diego Figueroa]

Hello,

We are trying to integrate with an SP who is requesting we release NameID as SAML 2.0 email address. However, when they send the AuthnRequest it contains:


<samlp:NameIDPolicy AllowCreate="true" Format="urn:mace:shibboleth:1.0:nameIdentifier" />


Our IdP throws an error and this is what we can see in the logs:


DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:96] - Trying to generate identifier with Format urn:mace:shibboleth:1.0:nameIdentifier
WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:328] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:mace:shibboleth:1.0:nameIdentifier
WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy
DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173] - Error event InvalidNameIDPolicy will be handled with response


The SP told us they are selecting the first format we have listed in our metadata which currently contains only:


<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

It is not clear to us what the NameIDFormat's in the metadata are supposed to be used for. Are SPs indeed supposed to pick the first NameIDFormat from the metadata and use it? All of our other integrations do not do this.

Any help you could offer or even a pointer to documentation would be appreciated.

Diego

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240820/ab26f6f5/attachment.htm>