<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Hi,</div>
<div><br>
</div>
<div>I have a working webex implementation with Shibboleth 2.3.3 and java 1.5. I am trying to complete an upgrade to Shibboleth 2.4 and java 1.7.</div>
<div><br>
</div>
<div>When I do the upgrade in my test environment, things seem to work ok except for the webex configuration. </div>
<div><br>
</div>
<div>The shib 2.3.3 debug log shows this:</div>
<div>
<div>14:35:45.085 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483] - Name identifier for relying party '<a href="http://www.webex-test.com'">http://www.webex-test.com'</a> will be built from attribute<b> 'webexID'</b></div>
</div>
<div><br>
</div>
<div>while under 2.4 (and 2.3.8), the debug log shows this:</div>
<div>12:07:31.903 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:850] -
<b>Using attribute 'transientId' </b>supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party '<a href="http://www.webex-test.com'">http://www.webex-test.com'</a></div>
<div><br>
</div>
<div>I am not sure why this would be? It must be a config issue somewhere but I can't find it. I want it to send webexID in format unspecified, not transientId in format transient.</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Joy</div>
<div>-------------------------------</div>
<div><br>
</div>
<b>relying-party.xml</b>
<div><br>
</div>
<div>
<div><rp:RelyingParty id="<a href="http://www.webex-test.com">http://www.webex-test.com</a>"</div>
<div> provider="<a href="https://shibidp-test.cit.cornell.edu/idp/shibboleth">https://shibidp-test.cit.cornell.edu/idp/shibboleth</a>"</div>
<div> defaultSigningCredentialRef="IdPCredential"></div>
<div> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" signAssertions\</div>
<div>="never"</div>
<div>/></div>
<div></rp:RelyingParty></div>
</div>
<div><br>
</div>
<div>[...]</div>
<div>
<div><MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"</div>
<div> id="WEBEXTEST"</div>
<div> metadataFile="/app/shibboleth/shibboleth-idp/metadata/webext-md.xml" /></div>
</div>
<div>[...]</div>
<div>--------------------------</div>
<div><b>webext-md.xml:</b></div>
<div>[...]</div>
<div>
<div><md:NameIDFormat></div>
<div>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat></div>
<div><md:NameIDFormat></div>
<div>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat></div>
<div><md:NameIDFormat></div>
<div>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat></div>
<div><md:NameIDFormat></div>
<div>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</md:NameIDFormat></div>
<div><md:NameIDFormat></div>
<div>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat></div>
<div><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://cornelltest.webex.com/dispatcher/SAML2AuthService?siteurl=cornelltest">https://cornelltest.webex.com/dispatcher/SAML2AuthService?siteurl=cornelltest</a>"
index="0" isDefault="true"/></div>
<div></md:SPSSODescriptor></div>
</div>
<div><br>
</div>
<div>[...]</div>
<div><br>
</div>
<div>----------------------</div>
<div><b>attribute-resolver.xml:</b></div>
<div><br>
</div>
<div>
<div> <resolver:AttributeDefinition id="webexID" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"</div>
<div> sourceAttributeID="uid"></div>
<div> <resolver:Dependency ref="myLDAP" /></div>
<div><br>
</div>
<div> <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div> name="urn:mace:dir:attribute-def:uid" /></div>
<div><br>
</div>
<div> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div> nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"</div>
<div> name="uid" /></div>
<div><br>
</div>
<div> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" /></div>
<div><br>
</div>
<div> </resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div>-------------------</div>
<div><b>attribute-filter.xml:</b></div>
<div>
<div> <AttributeFilterPolicy id="WEBEXTEST"></div>
<div> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://www.webex-test.com">http://www.webex-test.com</a>" /></div>
<div> <AttributeRule attributeID="webexID"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </AttributeRule></div>
<div><br>
</div>
<div> <AttributeRule attributeID="firstname"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </AttributeRule></div>
<div><br>
</div>
<div> <AttributeRule attributeID="lastname"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </AttributeRule></div>
<div><br>
</div>
<div> <AttributeRule attributeID="WEBEXemail"></div>
<div> <PermitValueRule xsi:type="basic:ANY" /></div>
<div> </AttributeRule></div>
<div><br>
</div>
<div></AttributeFilterPolicy></div>
</div>
<div><br>
</div>
<div><br>
</div>
</body>
</html>