I think there might be some misleading communication. For "nameIdentifiers", I am referring to "urn:mace:shibboleth:1.0:nameIdentifier", not really the general NameID.<br><br>If I understand correctly, "nameIdentifier" is one type of NameID, there are other types like persistent, transient, and so on. In the IdP metadata, it specifies what types are supported.<br>
<br>What I want to know is, if SP specify transient, it is very clear that the value will be a temporary number. but if SP specify "urn:mace:shibboleth:1.0:nameIdentifier" as the format, SP still doesn't know what will be the value inside the NameID. SP only knows that this value can represent this user. It can be email address, give name, or what ever. This is defined by IdP. Is that correct? Is there a place that defined what can be put inside the "nameIdentifier" so IdP and SP will follow this rule?<br>
<br>Also it says "urn.....<span style="color:rgb(153,0,0)">shibboleth:1.0</span>:nameIdentifier", does it mean it only works for SAML1.0? If I send a SAML2.0 AuthnRequest, will IdP return this?<br><br>Best,<br>
Yaowen<br>
<br><br><div class="gmail_quote">On Tue, Jul 31, 2012 at 6:36 PM, Kevin P. Foote <span dir="ltr"><<a href="mailto:kpfoote@iup.edu" target="_blank">kpfoote@iup.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
You can encode user name, email etc into a nameID yes. (see links)<br>
<br>
NameID requirements are specified in the metadata. Ex. The SP will<br>
specify what nameIdentifier format it will take / expect.<br>
<br>
I've only had to create/send out one or two custom nameIdentifiers.<br>
This usually happens when your dealing with someone elses (non<br>
Shibboleth project) implementation of SAML.<br>
<br>
The list archives also have lots of info/ threads on nameID formats and<br>
how the IdP goes through its selection process before creating the<br>
message.<br>
<div><br>
<br>
------<br>
thanks<br>
kevin.foote<br>
<br>
On Tue, 31 Jul 2012, Yaowen Tu wrote:<br>
<br>
</div>-> Thanks for your answer.<br>
-><br>
-> It looks like IdP can put anything they want into the "nameIdentifier" like<br>
-> email, user name, or anything. Is it correct?<br>
-><br>
-> If so, then how could SP know what will be in the nameIdentifier? Or SP<br>
-> needs to get this information in some other way from IdP?<br>
-><br>
-><br>
-> Yaowen<br>
-><br>
-><br>
-> On Tue, Jul 31, 2012 at 12:05 PM, Kevin P. Foote <<a href="mailto:kpfoote@iup.edu" target="_blank">kpfoote@iup.edu</a>> wrote:<br>
-><br>
-> ><br>
-> > You can encode different attributes (data) you have access to into<br>
-> > nameIdentifiers and then<br>
-> > send them out to the various RPs that require or request differing NameID<br>
-> > data..<br>
-> ><br>
-> > <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes</a><br>
-> ><br>
-> ><br>
-> > <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier</a><br>
-> ><br>
-> > <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier</a><br>
-> ><br>
-> > The IdPs default OOB config is to send the transientId as the NameID .. as<br>
-> > you have found.<br>
-> ><br>
-> > ------<br>
-> > thanks<br>
-> > kevin.foote<br>
-> ><br>
<div>-> > On Tue, 31 Jul 2012, Yaowen Tu wrote:<br>
-> ><br>
</div>-> > -> Hi,<br>
-> > -><br>
<div>-> > -> I have installed a sample Shib IdP, it is working in general. I am just<br>
</div>-> > -> trying to explore a little more.<br>
<div>-> > -><br>
-> > -> >From the IdP metadata, I see this:<br>
</div>-> > -><br>
<div>-> > <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat><br>
-> > -><br>
-> > -><br>
-> > -> So I assume, if an SP send this AuthnRequest, I am supposed to get an<br>
</div>-> > -> nameIdentifier from Assertion:<br>
<div>-> > -><br>
-> > -> <saml2p:AuthnRequest AssertionConsumerServiceURL="..." Destination="<br>
</div>-> > -> <a href="https://localhost/idp/profile/SAML2/Redirect/SSO" target="_blank">https://localhost/idp/profile/SAML2/Redirect/SSO</a>" ID="<br>
-> > -> _a90ed2b44c1d25860c411e0ab27a9edd"<br>
-> > -> IssueInstant="2012-07-31T18:21:28.759Z"<br>
-> > -> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>
-> > Version="<br>
-> > -> 2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><br>
-> > -> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>
-> > -> .....<br>
-> > -> </saml2:Issuer><br>
<div>-> > -> <saml2p:NameIDPolicy AllowCreate="true" Format="<br>
</div>-> > -> urn:mace:shibboleth:1.0:nameIdentifier"/><br>
<div>-> > -> </saml2p:AuthnRequest><br>
-> > -><br>
-> > -><br>
-> > -> In reality, from Idp-process.log, I see this information:<br>
-> > -><br>
-> > -><br>
-> > -><br>
-> > -> 11:22:01.373 - DEBUG<br>
</div>-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:465]<br>
-> > -> - Attempting to select name identifier attribute for relying party '...'<br>
-> > -> that requires format 'urn:mace:shibboleth:1.0:nameIdentifier'<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:548]<br>
-> > -> - Filtering out potential name identifier attributes which do not<br>
-> > support<br>
-> > -> one of the following formats: [urn:mace:shibboleth:1.0:nameIdentifier]<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:567]<br>
-> > -> - Retaining attribute transientId which may be encoded as a name<br>
-> > identifier<br>
-> > -> of format urn:mace:shibboleth:1.0:nameIdentifier<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:672]<br>
-> > -> - Selecting attribute to be encoded as a name identifier by encoder of<br>
-> > type<br>
-> > -><br>
-> > edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:699]<br>
-> > -> - Selecting the first attribute that can be encoded in to a name<br>
-> > identifier<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483]<br>
-> > -> - Name identifier for relying party '...' will be built from attribute<br>
-> > -> 'transientId'<br>
-> > -> 11:22:01.374 - DEBUG<br>
-> > -><br>
-> > [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:864]<br>
-> > -> - Using attribute 'transientId' supporting NameID format<br>
-> > -> 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the<br>
-> > NameID<br>
-> > -> for relying party '...'<br>
<div>-> > -><br>
-> > -> And in the Assertion, it is actually transient NameID.<br>
-> > -><br>
-> > -> Can you tell me why? Do I need to make any other configuration to be<br>
</div>-> > able<br>
-> > -> to get nameIdentifier?<br>
-> > -><br>
-> > -><br>
-> > -> Best,<br>
-> > -> Yaowen<br>
-> > -><br>
-> > --<br>
-> > To unsubscribe from this list send an email to<br>
-> > <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
-> ><br>
<div><div>-><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>