Ignoring NameIDFormat metadata that includes the 'unspecified' format

[izoret at cines.fr]

Hi Scott,

Thanks for this advice, 

I 'v tried to understand the process, without success ..

but i return on it.

Regards,

Philippe.

----- Mail original -----
De: "Cantor, Scott via users" <users at shibboleth.net>
À: "Shib Users" <users at shibboleth.net>
Cc: "Cantor, Scott" <cantor.2 at osu.edu>
Envoyé: Jeudi 8 Février 2024 14:36:12
Objet: Re: Ignoring NameIDFormat metadata that includes the 'unspecified' format

If the SP is asking you to provide an email address, then that's what I would provide it (with the proper Format).

Your problem is that you have to tell the IdP what to send the SP. Controlling NameID Format usage is based on the NameIDFormat element in metadata, or the nameIDFormatPrecedence property in a profile configuration override.

The documentation covers this and describes how Format selection works.

You should not just "make it work" by sending them unspecified, but if you insist on doing that, you will have to put that into a profile configuration override, as that is ignored when it's found in metadata.

Covered by [1] under "Dealing with "Unspecified".

-- Scott

[1] https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration


-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net