Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Christopher Bongaarts]

On 4/10/2025 3:00 PM, o haya via users wrote:
>
>         <saml2:Attribute FriendlyName="uid" 
> Name="urn:oid:0.9.2342.19200300.100.1.1" 
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml2:AttributeValue>test1</saml2:AttributeValue>
>         </saml2:Attribute>
>         <saml2:Attribute FriendlyName="eduPersonPrincipalName" 
> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" 
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>             <saml2:AttributeValue>test1 at xxxx.com</saml2:AttributeValue>
>         </saml2:Attribute>
>     </saml2:AttributeStatement>
> [...]
> Does the above mean that the Shibboleth IdP currently can get the 
> "uid" attribute from the user in LDAP (which we probably do use), and 
> not the "eduPersonPrincipalName" attribute (from the value it looks 
> like that might actually be the emailAddress attribute in the LDAP?) ?

It is able to get "uid" from LDAP, and it creates a 
eduPersonPrincipalName value based on a scope and the uid from LDAP.


> Also does that help for figuring out how to get the NameID to work?

NameIDs a are separate thing.  Check here:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507810/NameIDGenerationConfiguration

and the subtopic on Custom NameID generation has an example that might 
be relevant.


-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu          %%
%%  OIT - Identity Management  %%http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250410/78c3d108/attachment.htm>