Hi,<br><br>I have installed a sample Shib IdP, it is working in general. I am just trying to explore a little more.<br><br>From the IdP metadata, I see this:<br> <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br>
<br><br>So I assume, if an SP send this AuthnRequest, I am supposed to get an nameIdentifier from Assertion:<br><br><span class="e"><saml2p:AuthnRequest </span><span class="am">AssertionConsumerServiceURL</span>="<span class="ad">...</span>" <span class="am">Destination</span>="<span class="ad"><a href="https://localhost/idp/profile/SAML2/Redirect/SSO">https://localhost/idp/profile/SAML2/Redirect/SSO</a></span>" <span class="am">ID</span>="<span class="ad">_a90ed2b44c1d25860c411e0ab27a9edd</span>" <span class="am">IssueInstant</span>="<span class="ad">2012-07-31T18:21:28.759Z</span>" <span class="am">ProtocolBinding</span>="<span class="ad">urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</span>" <span class="am">Version</span>="<span class="ad">2.0</span>" <span class="am">xmlns:saml2p</span>="<span class="ad">urn:oasis:names:tc:SAML:2.0:protocol</span>"<span class="e">></span><br>
<span class="e"><saml2:Issuer </span><span class="am">xmlns:saml2</span>="<span class="ad">urn:oasis:names:tc:SAML:2.0:assertion</span>"<span class="e">></span><br> .....<br> <span class="e"></saml2:Issuer</span><span class="e">></span><br>
<span class="e"><saml2p:NameIDPolicy </span><span class="am">AllowCreate</span>="<span class="ad">true</span>" <span class="am">Format</span>="<span class="ad">urn:mace:shibboleth:1.0:nameIdentifier</span>"/<span class="e">></span><br>
<span class="e"></saml2p:AuthnRequest</span><span class="e">></span><br><br><br>In reality, from Idp-process.log, I see this information:<br><br><br><br>11:22:01.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:465] - Attempting to select name identifier attribute for relying party '...' that requires format 'urn:mace:shibboleth:1.0:nameIdentifier'<br>
11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:548] - Filtering out potential name identifier attributes which do not support one of the following formats: [urn:mace:shibboleth:1.0:nameIdentifier]<br>
11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:567] - Retaining attribute transientId which may be encoded as a name identifier of format urn:mace:shibboleth:1.0:nameIdentifier<br>
11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:672] - Selecting attribute to be encoded as a name identifier by encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder<br>
11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:699] - Selecting the first attribute that can be encoded in to a name identifier<br>11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483] - Name identifier for relying party '...' will be built from attribute 'transientId'<br>
11:22:01.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:864] - Using attribute 'transientId' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party '...'<br>
<br>And in the Assertion, it is actually transient NameID.<br><br>Can you tell me why? Do I need to make any other configuration to be able to get nameIdentifier?<br><br><br>Best,<br clear="all">Yaowen<br>