<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Thanks, that's what I needed, a deny rule in the webex attribute filter policy.
<div><br>
</div>
<div>Joy</div>
<div><br>
<div>
<div>On Sep 6, 2013, at 6:40 PM, Christopher Bongaarts <<a href="mailto:cab@UMN.EDU">cab@UMN.EDU</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 9/6/2013 2:58 PM, Joy Veronneau wrote:<br>
</div>
<blockquote cite="mid:6DCBAAD9-2C81-4C87-9ED0-377940A34D0E@cornell.edu" type="cite">
<div>Hi,</div>
<div><br>
</div>
<div>I have a working webex implementation with Shibboleth 2.3.3 and java 1.5. I am trying to complete an upgrade to Shibboleth 2.4 and java 1.7.</div>
<div><br>
</div>
<div>When I do the upgrade in my test environment, things seem to work ok except for the webex configuration. </div>
<div><br>
</div>
<div>The shib 2.3.3 debug log shows this:</div>
<div>
<div>14:35:45.085 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483] - Name identifier for relying party '<a moz-do-not-send="true" href="http://www.webex-test.com%27/">http://www.webex-test.com'</a> will be built from
attribute<b> 'webexID'</b></div>
</div>
<div><br>
</div>
<div>while under 2.4 (and 2.3.8), the debug log shows this:</div>
<div>12:07:31.903 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:850] -
<b>Using attribute 'transientId' </b>supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party '<a moz-do-not-send="true" href="http://www.webex-test.com%27/">http://www.webex-test.com'</a></div>
<div><br>
</div>
<div>I am not sure why this would be? It must be a config issue somewhere but I can't find it. I want it to send webexID in format unspecified, not transientId in format transient.</div>
</blockquote>
<br>
Do you have an attribute filter rule that releases transient by default? If so, make sure you either exclude webex-test or add an explicit Deny rule in the webex-test filter policy.<br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</div>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
</div>
</body>
</html>