<div dir="ltr">Would "nameid-format:emailAddress" be significantly different from "nameid-format:persistent"?<div><br></div><div>This is the encoding I have for the specific attribute I'm releasing:</div><div><br></div><div><div><resolver:AttributeDefinition id="cnIdentifiedName" xsi:type="ad:PrincipalName"></div><div> <resolver:Dependency ref="commonName" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>I thought that if I released the nameid in the form of an email address that I wouldn't need to release any other attributes.</div><div><br></div><div>Thanks, Kevin.</div><div><br></div><div>Mike</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 9, 2014 at 11:33 AM, Kevin Foote <span dir="ltr"><<a href="mailto:kpfoote@uoregon.edu" target="_blank">kpfoote@uoregon.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Oct 9, 2014, at 8:18 AM, Michael Dahlberg <<a href="mailto:olgamirth@gmail.com">olgamirth@gmail.com</a>> wrote:<br>
<br>
> I'm trying to configure our IdP for an external SP (<a href="http://widencollective.com" target="_blank">widencollective.com</a>). Authentication is successful (for the user "testuser") but immediately after that, I get an error page from the SP that states that "the access request was malformed". My logs show the following:<br>
><br>
> 10:59:41.442 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal 'testuser' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' for relying party '<a href="https://bucknell.widencollective.com" target="_blank">https://bucknell.widencollective.com</a>'<br>
> 10:59:41.454 - INFO [Shibboleth-Audit:1028] - 20141009T145941Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4e53a5ba-696d-4e6e-995f-ef4bec816e1b|<a href="https://bucknell.widencollective.com" target="_blank">https://bucknell.widencollective.com</a>|urn:mace:shibboleth:2.0:profiles:saml2:sso|<a href="https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||" target="_blank">https://shib.bucknell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15f35c49bb8308f399df9bf95795d0fd|testuser|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||||</a><br>
><br>
><br>
> In the attribute-filter.xml file, I deny the transientID and provide the attribute cnIdentifiedName, which is an SAML 2.0, persistent nameid attribute:<br>
<br>
</span>Your attribute may follow the spec of a persistent named attribute but, Is the attribute properly encoded for the nameID type specified?<br>
You have to encode this attribute in your attribute-resolver.xml to the the proper nameID format specified for that SP? Something like the following needs to be added<br>
to your <AttributeDefinition><br>
<br>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /><br>
<br>
You then have to release the attribute like normal and deny release of others like you did with transientId…<br>
<br>
HTH<br>
<br>
--------<br>
thanks<br>
<span class="HOEnZb"><font color="#888888"> kevin.foote<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>