Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-10 17:28 CEST]:
> FYI, I think that I was able to figure out how to run the command while
> specifying the IdP URL hostname and port:
> 
> ./reload-service.sh -u "https://idp01.xxxx.com:34487"
> -id=shibboleth.MetadataResolverService -tt JKS -tp xxxxx -ts
> /apps/apache-tomcat-10.1.39/conf/CERTS/JLCA.jks

This is not about reloading services -- you can just restart the IDP
instead. (If that taking too long annoys you, well, that's when you
start fixing your deployment.)

Anyway, try `-k https://localhost:34487` instead of all of the above.
Same for the aacli.

> Still have the same problem with no NameID in SAMLResponse after
> that though.

You're not reading what I wrote. Then why am I writing these things?

> The attribute resolver is necessary to get data into the IDP (into
> internal attributes) but it does not make NameIDs available. There's
> additional configuration required to create NameIDs from those
> internal attributes. [...]

-peter