<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 9, 2014 at 3:46 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">On 6/9/14, 3:34 PM, "Christopher Bongaarts" <<a href="mailto:cab@umn.edu">cab@umn.edu</a>> wrote:<br>
><br>
>Remember that NameID is a Highlander-class attribute (there can be only<br>
>one), so be sure to set up your attribute filter for this SP<br>
>appropriately (typically by adding a deny all values rule for<br>
>transientId if you're using the default release-to-everyone filter for<br>
>it).<br>
<br>
</div>I don't advise that at this point, all you need to do is one of:<br>
<br>
- add a <NameIDFormat> of the appropriate value to the SP's metadata<br>
- or if you don't control or don't want to modify the metadata, add a<br>
nameIDFormatPrecedence attribute to a RelyingParty definition for the SP<br>
<br></blockquote><div><br></div><div>I like these two options: much better than making changes to the default config which would effect all the SPs.</div><div><br></div><div>However, (and again my apologies if the answer is readily discoverable), I tried adding this to the metadata for the SP:</div>
<div><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</md:NameIDFormat><br></div><div><br></div><div>(we can use the WindowsDomainQualifiedName or the emailAddress) and I get the following error when attempting to login:</div>
<div><br></div><div><span style="color:rgb(255,0,0);font-family:Verdana,Helvetica,sans-serif;font-size:12px">Unable to login using Idp Error parsing 'NAME_ID' from SAML response</span><br></div><div><span style="color:rgb(255,0,0);font-family:Verdana,Helvetica,sans-serif;font-size:12px"><br>
</span></div><div>and I only get a warning in the idp-process.log file:</div><div>[org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder:134] - Relay state exceeds 80 bytes, some application may not support this.<br>
</div><div><br></div><div>Any suggestions on what the problem may be? Also, any suggestions on how to add a NameIDFormatPrecedence attribute to a RelyingParty definition?</div><div><br></div><div>Also, could you tell me what Nate meant by the NameIDs should be encoded as the Subject of an assertion?</div>
<div><br></div><div>Thanks very much,</div><div>Mike</div><div> </div></div></div></div>