<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I do not understand why my IdP did not release a NameID in the subject portion of the SAML assertion to a particular relying party.<div>I’ve reviewed <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier</a></div><div><br></div><div><span style="color: rgb(94, 48, 235);">I was able to send the transientID value as NameID by adding it explicitly to the attribute release policy for this SP, so I’ve resolved the operational issue, but I would like to know why the ‘releaseTransientIdToAnyone’ policy did not cover this case.</span><br><div><br></div><div>the SP metadata includes:<div><div style="margin: 0px; font-size: 13px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div><div style="margin: 0px; font-size: 13px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat></div><div><br></div><div>The IdP builds a TransientID:</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.234 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.<span style="color: rgb(255, 250, 194); background-color: rgb(0, 0, 0);">Transient</span>IdAttributeDefinition:97] - Building transient ID for request _3243897b9f3596fc1ccfb93040b1b10b; outbound message issuer: urn:mace:incommon:alaska.edu, inbound</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> message issuer: urn:amazon:webservices, principal identifer: dabantz</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.<span style="color: rgb(255, 250, 194); background-color: rgb(0, 0, 0);">Transient</span>IdAttributeDefinition:115] - Created transient ID _7a768c0d4ad1ad93e9623e5f23421e87 for request _3243897b9f3596fc1ccfb93040b1b10b</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;">09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute transientId containing 1 values</div></div><div><br></div><div>The attribute-filter contains the rule:</div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> <AttributeFilterPolicy id="release<span style="color: #fffac2; background-color: #000000">Transient</span>IdToAnyone"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> <PolicyRequirementRule xsi:type="basic:ANY" /></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> <AttributeRule attributeID="transientId"></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> <PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> </AttributeRule></div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); font-size: 10px;"> </AttributeFilterPolicy></div></div><div><br></div><div>Yet the IdP releases no NameID to this service:</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.423 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:527] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2<span style="color: rgb(255, 250, 194); background-color: rgb(0, 0, 0);">NameID</span>Encoder</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSsessionID, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2<span style="color: rgb(255, 250, 194); background-color: rgb(0, 0, 0);">NameID</span>Encoder</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSrole, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2<span style="color: rgb(255, 250, 194); background-color: rgb(0, 0, 0);">NameID</span>Encoder</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:504] - No attributes for principal 'dabantz' support encoding into a supported name identifier format for relying party 'urn:amazon:webservices'</div></div><div><br></div><div>resulting in a ‘nameless’ subject in the SAML assertion:</div></div></div><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><pre style="background-color: rgb(238, 238, 238); font-size: 11px; padding: 10px; position: static; z-index: auto;"><saml2:Subject>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="137.229.6.68" NotOnOrAfter="2014-08-11T16:25:38.711Z" Recipient="<a href="https://signin.aws.amazon.com/saml">https://signin.aws.amazon.com/saml</a>"/>
</saml2:SubjectConfirmation>
</saml2:Subject></pre></div></div><div><br></div><div><div>For OTHER relying parties / SPs the IdP uses TransientID for the NameID, as in:</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"><font color="#5e30eb">09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:868] - Using attribute 'transientId' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party '<a href="https://secure.aleks.com/shibboleth-sp'">https://secure.aleks.com/shibboleth-sp'</a></font></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"><font color="#5e30eb">09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:733] - Attempting to encrypt NameID to relying party '<a href="https://secure.aleks.com/shibboleth-sp'">https://secure.aleks.com/shibboleth-sp'</a></font></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"><font color="#5e30eb">Value = org.opensaml.saml2.core.impl.NameIDImpl@3cb8e2d7</font></div></div></div><div><br></div><div><br></div><div><font color="#5e30eb"><br></font></div><div><font color="#5e30eb">David Bantz</font></div><div><font color="#5e30eb">UA IAM</font></div></div></body></html>