<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div>Hi Todd,</div><div><br></div><div>I had to mess with something very similar for configuring ArcGIS. Here's what I had to do for this:</div><div><br></div><div style="color: rgb(0, 0, 0);">Here's what I did in saml-nameid.xml:</div><div><br></div><div style="color: rgb(0, 0, 0);"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div style="color: rgb(0, 0, 0);"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"</div><div style="color: rgb(0, 0, 0);"> p:attributeSourceIds="cn" /></div><div><br></div><div>The eid part is arbitrary, you just need to keep it consistent across the config You can have it be emailaddress too.</div><div><br></div><div style="color: rgb(0, 0, 0);">Then, in relying-party.xml:</div><div><br></div><div style="color: rgb(0, 0, 0);"><bean parent="RelyingPartyByName" c:relyingPartyIds="JMU.maps.arcgis.com"></div><div style="color: rgb(0, 0, 0);"> <property name="profileConfigurations"></div><div style="color: rgb(0, 0, 0);"> <list></div><div style="color: rgb(0, 0, 0);"> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"/></div><div style="color: rgb(0, 0, 0);"><span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span></list></div><div style="color: rgb(0, 0, 0);"> </property></div><div><span style="color: rgb(0, 0, 0);"> </bean></span> </div><div> </div><div><br></div><div><br></div><div>Hope this snippet helps.</div><div><br></div><div> </div><br class="Apple-interchange-newline"><span style="font-family: monospace; white-space: pre;">--
Brandon McKean
IT / Systems
Linux Administrator </span><div><span style="font-family: monospace; white-space: pre;">(540)568-4235</span> </div><div><br></div><div>On Wed, 2015-07-15 at 15:54 -0400, Todd Vernick wrote:</div><blockquote type="cite"><div dir="ltr"><div><div><div><div><div>My SP requires the assertion:<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<br></div>or<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br><br></div>I used the following config to pass uid to pass this in shibboleth version 2<br><br></div>attribute_resolver.xml<br> <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid"><br> <resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/><br> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/><br> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/><br> </resolver:AttributeDefinition><br><br></div>relying_party.xml<br> <rp:RelyingParty<br> id="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=" target="_blank">http://fs.ultiproworkplace.com/adfs/services/trust</a>"<br> provider="<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__idp.squarespace.net_idp_shibboleth&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=dprgEtghorgyPqpdnAUkp5NDCYNM_jn2o9hUNVWtDMw&e=" target="_blank">https://idp.squarespace.net/idp/shibboleth</a>"<br> defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"<br> defaultSigningCredentialRef="IdPCredential"><br><rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"<br> includeAttributeStatement="true"<br> assertionLifetime="300000"<br> assertionProxyCount="0"<br> signResponses="conditional"<br> signAssertions="never"<br> signRequests="conditional"<br> encryptAssertions="never"<br> encryptNameIds="never"<br>/><br> </rp:RelyingParty><br><br><br></div><div>Version 3 carried over a different relying_party config<br> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=" target="_blank">http://fs.ultiproworkplace.com/adfs/services/trust</a>"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="SAML2.SSO" p:encryptAssertions="false" /><br> </list><br> </property><br> </bean><br><br></div><div>And I used the same attribute_resolver config for version 3.<br></div>When decoding the saml response, it's not showing a 1.1:nameid-format anymore, only 2.0 formats.</div>
<pre>--
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre></blockquote></body></html>