<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div><span>Thanks. </span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>I commented out the "AttributeFilterPolicy" for "transientId" AttributeRule and now there is no response from IdP and i see the following in idp-process.log:</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;"><span>21:34:27.889 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of
principal 'user1' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' for relying party 'https://inw00003973:8443'<br></span></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><span><br></span></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><span>Thanks,</span></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><span>Vasu</span></div><div><br></div> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande',
sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Kevin P. Foote <kpfoote@iup.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, 21 November 2013 7:13 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: IdP: Returning emailAddress as NameId in SAMLResponse Assertion<br> </font> </div> <div class="y_msg_container"><br><div class="yqt7033496969" id="yqtfd92779"><br clear="none">On Thu, 21 Nov 2013, vyal2k wrote:<br clear="none"><br clear="none">> I am trying to have IdP return email address as the NameId in the Assertion (in response AuthnRequest). But the returned nameId value (in decrypted Assertion) is some sort of code
"_3ad95a453140ebc4894b5777f58096e2" instead of the authenticated user's email address (in LDAP) that i was expecting.<br clear="none">><br clear="none">> Here is attribute-resolver.xml at IdP:<br clear="none">> <resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail"><br clear="none">> <resolver:Dependency ref="myLDAP" /><br clear="none">> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br clear="none">> </resolver:AttributeDefinition><br clear="none">> <br clear="none">> Here is attribute-filter.xml at IdP:<br clear="none">> <afp:AttributeFilterPolicy id="citrixShareFile_nameID"><br clear="none">> <afp:PolicyRequirementRule xsi:type="basic:ANY" /><br
clear="none">> <afp:AttributeRule attributeID="email"><br clear="none">> <afp:PermitValueRule xsi:type="basic:ANY" /><br clear="none">> </afp:AttributeRule><br clear="none">> </afp:AttributeFilterPolicy><br clear="none">><br clear="none">> SP configuration at IdP: <SPSSODescriptor> includes:<br clear="none">> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat><br clear="none">><br clear="none">> And the AuthnRequest contains:<br clear="none">> <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/><br clear="none">><br clear="none">> Please let me know how to have IdP return authenticated user's email address to the SP.</div><br clear="none"><br clear="none">You are probably not removing the Transient NameId from the available<br clear="none">attributes at your filter.<br clear="none"><br clear="none">This
was just on a thread about 3 weeks ago..<br clear="none"><br clear="none">You need to place a DenyValueRule for the TransientId in your filter<br clear="none">rules for that entity.<br clear="none"><br clear="none"><br clear="none">------<br clear="none">thanks<br clear="none"> kevin.foote<br>--<br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br></div> </div> </div> </div></body></html>