<div dir="ltr">Hi<div><br></div><div style>I am trying to set my nameID as my principalName however I am having very litle succes with it. My principalName is set with the ldapLoginModule and it is just the username (A string)</div>
<div style><br></div><div style>If I understand correct TransientId and PersistentId require a mail like format and because I am getting something that is just any string, I want to get in unspecified format.</div><div style>
<br></div><div style>What I have done so far:</div><div style><br></div><div style>- Made sure that only "<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDForma>" is found in my idp-metadata.xml (I commented away the others)</div>
<div style>- Made sure to add only unspecified nameID (As above) to my sp-metadata.xml</div><div style>- Commented away the original attribute called transientId which contains 2 attribute encoders of transient format in attribute-resolver.xml</div>
<div style>- Added the following attribute to attribute-resolver.xml</div><div style> <resolver:AttributeDefinition xsi:type="ad:PrincipalName" id="pNameID" ></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /></div>
<div> </resolver:AttributeDefinition></div><div><br></div><div style>- Commented away the attributeFilterPolicy called "releaseTransientIdToAnyone" in attribute-filter.xml</div><div style>- Added the following attributeFilterPolicy to attribute-filter.xml</div>
<div style> <afp:AttributeFilterPolicy></div><div> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://myhost.com/">https://myhost.com/</a>"/></div>
<div><br></div><div> <afp:AttributeRule attributeID="pNameID"></div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div> </afp:AttributeRule></div><div>
</afp:AttributeFilterPolicy></div><div><br></div><div><br></div><div style>It feels to me that this should be enough, yet in debug logs I keept seeing the following message:</div><div style><br></div><div style>
No attribute of principal 'someString' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party '<a href="https://myhost.com/">https://myhost.com/</a>'<br>
</div><div style><br></div><div style><br></div><div style>I don't understand why it keeps saying that it wants a transient format (Which I believe is what is stopping it from adding to nameId due to no mail format).</div>
<div style><br></div><div style>Any help is appreciated, am I doing something wrong?</div><div style><br></div><div style>I based my actions on the following page <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeExamples">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeExamples</a> with the small change that I am using a principalName attributeDefinition type instead of Simple.</div>
</div>