<div dir="ltr">Nate and Christopher:<div><br></div><div>You may be right about not giving me enough info about what they're looking for because in their docs they just say </div><div><br></div><div>add this to attribute-resolver.xml</div>
<div><br></div><div><div> <!-- Name identifier for passing principal name to ArcGIS Online --></div><div> <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"></div>
<div> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" /></div>
<div> </resolver:AttributeDefinition></div></div><div><br></div><div>and this to attribute-filter.xml</div><div><br></div><div><div> <!-- Release the NameID to <a href="http://city.maps.arcgis.com">city.maps.arcgis.com</a> --></div>
<div> <afp:AttributeFilterPolicy></div><div> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://city.maps.arcgis.com">city.maps.arcgis.com</a>" /></div>
<div> <afp:AttributeRule attributeID="principal"></div><div> <afp:PermitValueRule xsi:type="basic:ANY"/></div><div> </afp:AttributeRule></div><div> </afp:AttributeFilterPolicy></div>
</div><div><br></div><div>My problem is that the attribute that is released and/or the one that they are using is the transientID and I really need them to use the email address.</div><div><br></div><div>How can one deny the release of an attribute?</div>
<div><br></div><div>Thanks,</div><div>Mike</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jun 9, 2014 at 3:34 PM, Christopher Bongaarts <span dir="ltr"><<a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 6/9/2014 2:25 PM, Michael Dahlberg wrote:<br>
> I'm running a Shibboleth 2.40 IdP and am trying to release the email<br>
> address attribute to the SP. The SP asks that the attribute encoder<br>
> be of type SAML2StringNameID. I assume I need to modify the<br>
> nameFormat parameter from the default specification:<br>
> "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" to something<br>
> else. Any suggestions would be most helpful.<br>
<br>
</div>You don't have to, but it's not a bad idea, perhaps to:<br>
<br>
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
<br>
Remember that NameID is a Highlander-class attribute (there can be only<br>
one), so be sure to set up your attribute filter for this SP<br>
appropriately (typically by adding a deny all values rule for<br>
transientId if you're using the default release-to-everyone filter for it).<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% <a href="tel:%2B1%20%28612%29%20625-1809" value="+16126251809">+1 (612) 625-1809</a> %%<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>