NameID Format/Policy help

[Paul B. Henson]

As defined by the specification available at:

	https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

the NameIDFormat element indicates which name ID formats are supported 
by your idp.

So basically you are telling the SP they can ask for it, and then you 
can't provide it, which isn't really their fault…

I don't know how that specific format ended up in your metadata, but you 
should probably remove it, given you can't generate it.

It's an optional element, so you can either remove it completely, or if 
you want to keep it, make sure it is an accurate representation of the 
set of name ID formats that you can generate.


On 8/20/2024 1:36 PM, Diego Figueroa via users wrote:
> Hello,
> 
> We are trying to integrate with an SP who is requesting we release 
> NameID as SAML 2.0 email address. However, when they send the 
> AuthnRequest it contains:
> 
> 
> <samlp:NameIDPolicy AllowCreate="true" 
> Format="urn:mace:shibboleth:1.0:nameIdentifier" />
> 
> 
> Our IdP throws an error and this is what we can see in the logs:
> 
> 
> DEBUG 
> [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:96] - Trying to generate identifier with Format urn:mace:shibboleth:1.0:nameIdentifier
> WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:328] - 
> Profile Action AddNameIDToSubjects: Request specified use of an 
> unsupportable identifier format: urn:mace:shibboleth:1.0:nameIdentifier
> WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed 
> event occurred while processing the request: InvalidNameIDPolicy
> DEBUG 
> [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173] 
> - Error event InvalidNameIDPolicy will be handled with response
> 
> 
> The SP told us they are selecting the first format we have listed in our 
> metadata which currently contains only:
> 
> 
> <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
> 
> It is not clear to us what the NameIDFormat's in the metadata are 
> supposed to be used for. Are SPs indeed supposed to pick the first 
> NameIDFormat from the metadata and use it? All of our other integrations 
> do not do this.
> 
> Any help you could offer or even a pointer to documentation would be 
> appreciated.