<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">To tie up this thread, I was able to “build” and attribute syntactically identical to ePPN<div>that is released as the domain-qualified NameID in the Subject of the SAML assertion using</div><div>the definition below. I’m not proud of it, but it seems to do the job.</div><div><br></div><div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(184, 184, 184);"><!— Create NameID like ePPN for the SAML Subject --></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"><resolver:AttributeDefinition </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:resolver:ad"<span style="color: #091480"> </span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #4b5a7d">xmlns:xsi=</span>"<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<span style="color: #091480"> </span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"> </span><span style="color: #4b5a7d">xmlns:resolver=</span>"urn:mace:shibboleth:2.0:resolver"<span style="color: #091480"> </span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"> <span style="color: #098021">id=</span><span style="color: #ff9300">"oktanameid"</span> <span style="color: #098021">xsi:type=</span><span style="color: #ff9300">"Script"</span> </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"> <span style="color: #098021">sourceAttributeID=</span><span style="color: #ff9300">"UASystemID"</span>></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><resolver:Dependency <span style="color: #098021">ref=</span><span style="color: #ff9300">"myLDAP"</span>/></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #091480"><resolver:AttributeEncoder </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"<span style="color: #091480"> </span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><span class="Apple-tab-span" style="white-space:pre"> </span> <span style="color: #098021">xsi:type=</span><span style="color: #ff9300">"SAML2StringNameID"</span> </div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"><span class="Apple-tab-span" style="white-space:pre"> </span> </span><span style="color: #098021">nameFormat=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<span style="color: #091480">/></span></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(75, 90, 125);"><span style="color: #323333"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #091480"><Script></span><![CDATA[</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> importPackage(Packages.org.slf4j);</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51); min-height: 16px;"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> if (null == oktanameid) {oktanameid = new BasicAttribute("oktanameid");}</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> oktausername = UASystemID.getValues().get(0);</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51);"> oktanameid.getValues().add(oktausername + "@<a href="http://alaska.edu">alaska.edu</a>");</div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(50, 51, 51); min-height: 16px;"><br></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><span style="color: #323333"> </span><span style="color: #4b5a7d">]]></span></Script></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"></resolver:AttributeDefinition></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(9, 20, 128);"><br></div><div><div>On Thu, 28 Aug 2014, at 13:53 , Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 8/28/14, 5:48 PM, "David Bantz" <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br><br></blockquote><div></div><blockquote type="cite"><div></div></blockquote><blockquote type="cite"><blockquote type="cite"><div>Attempting to build a NameID in the SAML subject to meet a vendor requirement.</div><div>The following uses and inserts the right identifier, but despite being based on ePPN, </div><div>appears in the SAML assertion subject un-scoped: If ePPN is <a href="mailto:george@my.domain">george@my.domain</a>, this </div><div>uses the NameID of george in subject portion of the SAML. To meet vendor requirement,</div><div>I need the scoped value <a href="mailto:george@my.domaim">george@my.domaim</a>. Is there a simple way to do that?</div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(79, 45, 222); background-color: rgb(255, 250, 194);"><!-- Okta requires something like ePPN in the SAML Subject --></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><<span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span>AttributeDefinition</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">id</span><span style="color: rgb(0, 0, 0);">=</span>"oktanameid"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xsi</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 184, 32);">type</span><span style="color: rgb(0, 0, 0);">=</span>"Simple"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xmlns</span><span style="color: rgb(0, 0, 0);">=</span>"urn:mace:shibboleth:2.0:resolver:ad"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">sourceAttributeID</span><span style="color: rgb(0, 0, 0);">=</span>"eduPersonPrincipalName"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xmlns</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 184, 32);">xsi</span><span style="color: rgb(0, 0, 0);">=</span>"<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xmlns</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 184, 32);">resolver</span><span style="color: rgb(0, 0, 0);">=</span>"urn:mace:shibboleth:2.0:resolver"<span style="color: rgb(44, 182, 195);">></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: rgb(0, 0, 0);"> </span><<span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span>Dependency <span style="color: rgb(44, 184, 32);">ref</span><span style="color: rgb(0, 0, 0);">=</span><span style="color: rgb(191, 52, 29);">"myLDAP"</span> /></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(0, 0, 0);"> </span><span style="color: rgb(44, 182, 195);"><</span><span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 182, 195);">Dependency </span><span style="color: rgb(44, 184, 32);">ref</span><span style="color: rgb(0, 0, 0);">=</span>"eduPersonPrincipalName"<span style="color: rgb(44, 182, 195);"> /></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: rgb(0, 0, 0);"> </span><<span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span>AttributeEncoder</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xsi</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 184, 32);">type</span><span style="color: rgb(0, 0, 0);">=</span>"SAML2StringNameID"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xmlns</span><span style="color: rgb(0, 0, 0);">=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">nameFormat</span><span style="color: rgb(0, 0, 0);">=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<span style="color: rgb(44, 182, 195);"> /></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: rgb(0, 0, 0);"> </span><<span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span>AttributeEncoder</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xsi</span><span style="color: rgb(79, 45, 222);">:</span><span style="color: rgb(44, 184, 32);">type</span><span style="color: rgb(0, 0, 0);">=</span>"SAML2String"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">xmlns</span><span style="color: rgb(0, 0, 0);">=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(191, 52, 29); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span><span style="color: rgb(44, 184, 32);">name</span><span style="color: rgb(0, 0, 0);">=</span>"urn:oid:1.3.6.1.4.1.5923.1.1.1.6"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 184, 32); background-color: rgb(255, 250, 194);"><span style="color: rgb(44, 182, 195);"> </span>friendlyName<span style="color: rgb(0, 0, 0);">=</span><span style="color: rgb(191, 52, 29);">"username"</span><span style="color: rgb(44, 182, 195);"> /></span></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; color: rgb(44, 182, 195); background-color: rgb(255, 250, 194);"><span style="color: rgb(0, 0, 0);"> </span></<span style="color: rgb(208, 54, 207);">resolver</span><span style="color: rgb(79, 45, 222);">:</span>AttributeDefinition></div></div></blockquote></blockquote><div><br></div><blockquote type="cite"><br>Not simple, you'd have to get an attribute defined that's string-valued<br>with both parts included, and attach the encoder to that. Basically what<br>you'd do with mail.<br><br>I fixed this in v3 when the new portion of the IdP is used to generate<br>NameIDs instead of the resolver.<br><br>-- Scott<br><br>-- <br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></body></html>