Ignoring NameIDFormat metadata that includes the 'unspecified' format

[Nate Klingenstein]

Philippe,

> upn_sent_by_idp"AAdzZWNyZXQxZeIj7ngxkWk5Tj4m3bop3J9JiSA+Z3DytGzRR4ETuJVZB2h2AsfLXU31s+sl9+tcytAvR+PDBoGQ+TWFFnYDRfxUV3+BnnjBL85/Z0MhMOMMT0JYSuKXEVolm3rboSS5n1XRACMzbhaNKWZEFGzfHBWxxkA6w=="

> IDP seems doing the job, but not the SP. 

This is indicative of the IdP sending a transientID rather than an unspecified ID, so I think the problem remains on your end for now.

First, you’ll need an unspecified NameID defined to release. This is done in same-nameid.xml, but it references attributes defined in the attribute resolver.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration#General-Procedure
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration#General-Procedure

Then, you need the override in place. That may or may not be there; we can’t tell without seeing your logs.

Hope this helps,
Nate
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240207/62f54dfc/attachment.htm>