<div dir="ltr">Hi, Peter. Thanks for the pointers. I fixed a few mistakes on the permissions that releases the attribute so that for each specific SP (I have a couple additional ones in the file which I did not list), it only releases the specified attribute. I have also fixed the format to email address in the metadata as well as in the attribute-resolver.xml files. However it is still putting the &quot;cn&quot; from eDirectory (which is the username) into the NameID field. <div><br></div><div>Any ideas?</div><div><br></div><div> -Andrew</div><div><br></div><div><br></div><div>The configurations now look like the following:<div><br></div><div>attribute-filter.xml:</div><div><div><br></div><div> &lt;afp:AttributeFilterPolicy id=&quot;doNotReleaseTransientIdToAnyoneMySiteA&quot;&gt;</div><div>  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:NOT&quot;&gt;</div><div>    &lt;basic:Rule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://mail.google.com/a/dev.mySiteA.ca">mail.google.com/a/dev.mySiteA.ca</a>&quot; /&gt;</div><div>  &lt;/afp:PolicyRequirementRule&gt;</div><div>   &lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;</div><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></div><div><br></div><div><div>&lt;afp:AttributeFilterPolicy id=&quot;releaseGoogleMySiteAEmail&quot;&gt;</div><div>  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://google.com/a/dev.mySiteA.ca">google.com/a/dev.mySiteA.ca</a>&quot;/&gt;</div><div>  &lt;afp:AttributeRule attributeID=&quot;GoogleMySiteAEmail&quot;&gt;</div><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></div><div><br></div><div><br></div><div>----------------</div><div>attribute-resolver.xml:</div><div><br></div><div><div>&lt;resolver:AttributeDefinition xsi:type=&quot;PrincipalName&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot;</div><div>                              id=&quot;GoogleMySiteAEmail&quot;</div><div>                              sourceAttributeID=&quot;email&quot;&gt;</div><div> &lt;resolver:Dependency ref=&quot;myLDAP&quot; /&gt;</div><div>   &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML1StringNameIdentifier&quot; nameFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot;/&gt;</div><div>  &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; nameFormat=&quot;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&quot;/&gt;</div></div><div><br></div><div><br></div><div>-------------------------</div><div><br></div><div>googleMySiteA-metadata.xml :</div><div><br></div><div><div>&lt;EntityDescriptor entityID=&quot;<a href="http://google.com/a/dev,mySiteA.ca">google.com/a/dev,mySiteA.ca</a>&quot; xmlns=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot;&gt;</div><div>    &lt;SPSSODescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</div><div>        &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/NameIDFormat&gt;</div><div>        &lt;AssertionConsumerService index=&quot;1&quot; Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot;</div><div>            Location=&quot;<a href="https://www.google.com/a/dev.mySiteA.ca/acs">https://www.google.com/a/dev.mySiteA.ca/acs</a>&quot; /&gt;</div><div>    &lt;/SPSSODescriptor&gt;</div><div>&lt;/EntityDescriptor&gt;</div></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div class="gmail_signature"><div dir="ltr"><br></div></div>
</div></div>