<div dir="ltr"><div>I&#39;m having a problem getting my IdP to provide the correct attributes to a SP (<a href="http://maps.arcgis.com">maps.arcgis.com</a>)</div><div><br></div><div>I&#39;ve configured my IdP to release the userPrincipalName </div>
<div><span class="" style="white-space:pre">        </span></div><div><span class="" style="white-space:pre">        </span>&lt;resolver:AttributeDefinition xsi:type=&quot;ad:Simple&quot; id=&quot;userPrincipalName&quot; sourceAttributeID=&quot;userPrincipalName&quot;&gt;</div>
<div>        &lt;resolver:Dependency ref=&quot;myLDAP&quot; /&gt;</div><div>        &lt;resolver:AttributeEncoder xsi:type=&quot;SAML2StringNameID&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot;</div><div>
            nameFormat=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified&quot; /&gt;</div><div>    &lt;/resolver:AttributeDefinition&gt;</div><div><span class="" style="white-space:pre">        </span></div><div>and, by default, the transientId is released as well:</div>
<div><br></div><div>    &lt;resolver:AttributeDefinition id=&quot;transientId&quot; xsi:type=&quot;ad:TransientId&quot;&gt;</div><div>        &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML1StringNameIdentifier&quot; nameFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot; /&gt;</div>
<div>        &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; nameFormat=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot; /&gt;</div><div>    &lt;/resolver:AttributeDefinition&gt;</div>
<div><br></div><div><span class="" style="white-space:pre">        </span></div><div>Configured in this manner, authentication occurs without a problem.  However, the site uses the transientId as the username.  Obviously, this is a problem because the work that a given user does is not available to him/her on subsequent logins.</div>
<div><br></div><div>If I disable the release of the transientId by applying the following Attribute Rule to this site&#39;s Attribute Filter Policy</div><div><span class="" style="white-space:pre">                </span></div><div><span class="" style="white-space:pre">                </span>&lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;</div>
<div>            &lt;afp:DenyValueRule xsi:type=&quot;basic:ANY&quot;/&gt;</div><div>        &lt;/afp:AttributeRule&gt;</div><div><span class="" style="white-space:pre">                </span></div><div>authentication does not occur and I&#39;m presented with the error &quot;Unable to login using Idp &#39;NAME_ID&#39; not found in SAML response&quot;.</div>
<div><br></div><div>Is there any way I can create an attribute like the transientId that will include &#39;NAME_ID&#39; (not sure what that is) that I can then pass to the SP with a consistent, easily recognizable value?  Or am I approaching this in the wrong manner?</div>
<div><br></div><div>Thanks,</div><div>Mike</div></div>