<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Hi,</div><div> I am trying to have IdP return email address as the NameId in the Assertion (in response AuthnRequest). But the returned nameId value (in decrypted Assertion) is some sort of code "_3ad95a453140ebc4894b5777f58096e2" instead of the authenticated user's email address (in LDAP) that i was expecting.</div><div><br></div><div style="background-color: transparent;">Here is attribute-resolver.xml at IdP:</div><div style="background-color: transparent;"> <resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail"></div><div style="background-color: transparent;"> <resolver:Dependency ref="myLDAP" /></div><div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre">
</span><resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div style="background-color: transparent;"> </resolver:AttributeDefinition></div><div style="background-color: transparent;"> </div><div style="background-color: transparent;">Here is attribute-filter.xml at IdP:</div><div style="background-color: transparent;"><afp:AttributeFilterPolicy id="citrixShareFile_nameID"></div><div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"> </span><afp:PolicyRequirementRule xsi:type="basic:ANY" /></div><div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"> </span><afp:AttributeRule attributeID="email"></div><div style="background-color: transparent;"><span class="Apple-tab-span"
style="white-space:pre"> </span><afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"> </span></afp:AttributeRule></div><div style="background-color: transparent;"></afp:AttributeFilterPolicy></div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;">SP configuration at IdP: <SPSSODescriptor> includes:</div><div style="background-color: transparent;"><NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat></div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;">And the AuthnRequest contains:</div><div style="background-color: transparent;"><saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/></div><div style="background-color: transparent;"><br></div><div
style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">Please let me know how to have IdP return authenticated user's email address to the SP.</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">Thanks,</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">Vasu</div></div></body></html>