Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

Hi Peter (et al),

FYI, for the NameID, I did as you suggested in your earlier post:

In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:
>   <util:list id="shibboleth.SAML2NameIDGenerators">
> here's what you'd add:
>
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>             p:omitQualifiers="true"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'mail'} }" />
>
> Provided that the IDP has an internal attribute called 'mail' which
> holds the subject's email address from whatever data source.
> If your LDAP server has the subject's email adresss in the LDAP
> attribute "cn" (which I would find highly unusual) then you could
> either rename the attribute with your IDP attribute resolver by adding
> this to the end of your LDAP DataConnector:
>   <Column columnName="cn" attributeID="mail" />
> of you'd change the above example for the NameID generation to use
> 'cn' where it currently says 'mail'.
>


Actually, there was already the section that you described above in the
file, but it was commented out.

So, all I had to do was UNcomment that section, and changed the "mail" to
"cn" (exactly as you said) and now, I am seeing the NameID in the
SAMLResponse!!

Also FYI, I tested with the other IdP "in front" and I am now getting
successful authentication all the way "back" to the "in front" SP/IdP!!

AMAZING :(!!

Thanks again, to everyone, for all of your help, and (again), patience!!

Jim

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Fri, Apr 11, 2025 at 8:18 AM Peter Schober via users <
users at shibboleth.net> wrote:

> o haya via users <users at shibboleth.net> [2025-04-11 02:29 CEST]:
> > After some discussion, we want the NameID format to be emailAddress, and
> > for the source to be the "cn" attribute. Also "cn" values will be
> > emailAddress format.
>
> In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:
>   <util:list id="shibboleth.SAML2NameIDGenerators">
> here's what you'd add:
>
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>             p:omitQualifiers="true"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'mail'} }" />
>
> Provided that the IDP has an internal attribute called 'mail' which
> holds the subject's email address from whatever data source.
> If your LDAP server has the subject's email adresss in the LDAP
> attribute "cn" (which I would find highly unusual) then you could
> either rename the attribute with your IDP attribute resolver by adding
> this to the end of your LDAP DataConnector:
>   <Column columnName="cn" attributeID="mail" />
> of you'd change the above example for the NameID generation to use
> 'cn' where it currently says 'mail'.
>
> So first get the data into the IDP, then put it into a NameID.
> The final piece is making sure the NameID with the desired Format is
> sent to the SP in question. The correct and easiest way to do this is
> my amending the SP Metadata (that the IDP has on record) with the
> desired NameID Format:
>
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
>
> HTH,
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250411/9b42f6c3/attachment.htm>