Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-11 02:29 CEST]:
> After some discussion, we want the NameID format to be emailAddress, and
> for the source to be the "cn" attribute. Also "cn" values will be
> emailAddress format.

In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:
  <util:list id="shibboleth.SAML2NameIDGenerators">
here's what you'd add:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"                                                       
            p:omitQualifiers="true"                                                                                    
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"       
            p:attributeSourceIds="#{ {'mail'} }" />

Provided that the IDP has an internal attribute called 'mail' which
holds the subject's email address from whatever data source.
If your LDAP server has the subject's email adresss in the LDAP
attribute "cn" (which I would find highly unusual) then you could
either rename the attribute with your IDP attribute resolver by adding
this to the end of your LDAP DataConnector:
  <Column columnName="cn" attributeID="mail" />
of you'd change the above example for the NameID generation to use
'cn' where it currently says 'mail'.

So first get the data into the IDP, then put it into a NameID.
The final piece is making sure the NameID with the desired Format is
sent to the SP in question. The correct and easiest way to do this is
my amending the SP Metadata (that the IDP has on record) with the
desired NameID Format:
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

HTH,
-peter