Thanks for your answer. <br><br>It looks like IdP can put anything they want into the "nameIdentifier" like email, user name, or anything. Is it correct?<br><br>If so, then how could SP know what will be in the nameIdentifier? Or SP needs to get this information in some other way from IdP?<br>
<br><br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Tue, Jul 31, 2012 at 12:05 PM, Kevin P. Foote <span dir="ltr"><<a href="mailto:kpfoote@iup.edu" target="_blank">kpfoote@iup.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
You can encode different attributes (data) you have access to into nameIdentifiers and then<br>
send them out to the various RPs that require or request differing NameID data..<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes</a><br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier</a><br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier</a><br>
<br>
The IdPs default OOB config is to send the transientId as the NameID .. as<br>
you have found.<br>
<br>
------<br>
thanks<br>
kevin.foote<br>
<br>
On Tue, 31 Jul 2012, Yaowen Tu wrote:<br>
<br>
-> Hi,<br>
-><br>
-> I have installed a sample Shib IdP, it is working in general. I am just<br>
-> trying to explore a little more.<br>
-><br>
-> >From the IdP metadata, I see this:<br>
-> <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br>
-><br>
-><br>
<div>-> So I assume, if an SP send this AuthnRequest, I am supposed to get an<br>
</div>-> nameIdentifier from Assertion:<br>
-><br>
-> <saml2p:AuthnRequest AssertionConsumerServiceURL="..." Destination="<br>
-> <a href="https://localhost/idp/profile/SAML2/Redirect/SSO" target="_blank">https://localhost/idp/profile/SAML2/Redirect/SSO</a>" ID="<br>
-> _a90ed2b44c1d25860c411e0ab27a9edd"<br>
-> IssueInstant="2012-07-31T18:21:28.759Z"<br>
-> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="<br>
-> 2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><br>
-> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>
-> .....<br>
-> </saml2:Issuer><br>
<div>-> <saml2p:NameIDPolicy AllowCreate="true" Format="<br>
</div>-> urn:mace:shibboleth:1.0:nameIdentifier"/><br>
-> </saml2p:AuthnRequest><br>
-><br>
-><br>
<div>-> In reality, from Idp-process.log, I see this information:<br>
</div>-><br>
-><br>
-><br>
-> 11:22:01.373 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:465]<br>
-> - Attempting to select name identifier attribute for relying party '...'<br>
-> that requires format 'urn:mace:shibboleth:1.0:nameIdentifier'<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:548]<br>
-> - Filtering out potential name identifier attributes which do not support<br>
-> one of the following formats: [urn:mace:shibboleth:1.0:nameIdentifier]<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:567]<br>
-> - Retaining attribute transientId which may be encoded as a name identifier<br>
-> of format urn:mace:shibboleth:1.0:nameIdentifier<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:672]<br>
-> - Selecting attribute to be encoded as a name identifier by encoder of type<br>
-> edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:699]<br>
-> - Selecting the first attribute that can be encoded in to a name identifier<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483]<br>
-> - Name identifier for relying party '...' will be built from attribute<br>
-> 'transientId'<br>
-> 11:22:01.374 - DEBUG<br>
-> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:864]<br>
-> - Using attribute 'transientId' supporting NameID format<br>
-> 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID<br>
-> for relying party '...'<br>
-><br>
-> And in the Assertion, it is actually transient NameID.<br>
-><br>
-> Can you tell me why? Do I need to make any other configuration to be able<br>
-> to get nameIdentifier?<br>
-><br>
-><br>
-> Best,<br>
-> Yaowen<br>
-><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br>