<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 11 June 2015 at 23:01, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">On 6/11/15, 9:09 PM, "users on behalf of Alain O'Dea" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:alain.odea@gmail.com">alain.odea@gmail.com</a>> wrote:<br>
<br>
>If I hack the format I get NameID values I can't use. I need the email address on the SP. I don't want to do anything that will compromise my SP's support for other IdPs.<br>
<br>
</span>SPs should use Attributes not NameIDs. You don't want to bother with NameIDs, they're limiting and brittle. The only NameID types that should ever be used are transient and persistent. The former is only used to support extended use cases like logout, otherwise you just omit it.<br>
<span class=""><br>
>I have the following in conf/attribute-resolver-ldap.xml:<br>
<br>
</span>Assuming this is V3, that's not the suggested way to handle NameID generation anymore, but regardless, your issue here is that you have the wrong constant. The unspecified constant should be as you have in your resolver, but the value the SP's metadata has is incorrect, it's got "2.0" in the constant string instead of 1.1.<br>
<br>
And in any case, using the real constant in the SP's metadata will do nothing. The IdP will ignore it because you told it you didn't care what the format is (that's what "unspecified" means).<br>
<span class=""><font color="#888888"><br>
-- Scott</font></span></blockquote><div><br></div><div class="gmail_extra">I like this solution Scott. Thank you.<br class=""><br></div><div class="gmail_extra">I am now using urn:oasis:names:tc:SAML:2.0:nameid-format:transient and releasing the mail attribute in conf/attribute-filter.xml:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra"> <afp:AttributeFilterPolicy></div><div class="gmail_extra"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://localhost:8080/consume.jsp" target="_blank">http://localhost:8080/consume.jsp</a>" /></div><div class="gmail_extra"> <afp:AttributeRule attributeID="mail"><br></div><div class="gmail_extra"> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div class="gmail_extra"> </afp:AttributeRule></div><div class="gmail_extra"> </afp:AttributeFilterPolicy></div><div><br></div></div><div>Then I retrieve its value under the standard SAML2 attritbute name of "urn:oid:0.9.2342.19200300.100.1.3" in my SP. Works very cleanly.</div><div><br></div><div>Next step for me now is migrating to OpenSAML for my SP.</div></div></div></div>