<div dir="ltr"><div><div>Did you make any changes to saml-nameid.properties?<br></div>Also what did you use for your attribute-resolver.xml?<br></div>I took the default uid instance from attribute-resolver-full.xml<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 15, 2015 at 4:35 PM, McKean, Brandon Scott - mckeanbs <span dir="ltr"><<a href="mailto:mckeanbs@jmu.edu" target="_blank">mckeanbs@jmu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>Hi Todd,</div><div><br></div><div>Sorry it's giving you trouble. :(</div><div><br></div><div>For clarity you wouldn't be able to straight copy what I gave. In your case saml-nameid.xml would probably need to be more like:</div><div><br></div><div><div style="color:rgb(0,0,0)"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div style="color:rgb(0,0,0)"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div style="color:rgb(0,0,0)"> p:attributeSourceIds="uid" /></div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)">Then in relying-party.xml right next to "p:encryptAssertions="false" in that section:</div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)"><div>p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div><br></div><div>Hope that makes sense, but let me know if that's how you did it already.</div><div><br></div><div>Thanks,</div><span class=""><div><br></div><br><span style="color:rgb(46,52,54);font-family:monospace;white-space:pre-wrap">--
Brandon McKean
IT / Systems
Linux Administrator </span><div><span style="color:rgb(46,52,54);font-family:monospace;white-space:pre-wrap"><a href="tel:%28540%29568-4235" value="+15405684235" target="_blank">(540)568-4235</a></span> </div></span></div></div><div><div class="h5"><div><br></div><div>On Wed, 2015-07-15 at 16:17 -0400, Todd Vernick wrote:</div><blockquote type="cite"><div dir="ltr"><div>Hi Brandon,<br></div><div>I just added what you specified but still don't see the 1.1 values :(<br></div><div><span style="font-family:monospace;white-space:pre-wrap"></span></div><span style="font-family:monospace;white-space:pre-wrap"></span></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 15, 2015 at 4:06 PM, McKean, Brandon Scott - mckeanbs <span dir="ltr"><<a href="mailto:mckeanbs@jmu.edu" target="_blank">mckeanbs@jmu.edu</a>></span> wrote:<br><blockquote type="cite"><div><div>Hi Todd,</div><div><br></div><div>I had to mess with something very similar for configuring ArcGIS. Here's what I had to do for this:</div><div><br></div><div style="color:rgb(0,0,0)">Here's what I did in saml-nameid.xml:</div><div><br></div><div style="color:rgb(0,0,0)"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div style="color:rgb(0,0,0)"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"</div><div style="color:rgb(0,0,0)"> p:attributeSourceIds="cn" /></div><div><br></div><div>The eid part is arbitrary, you just need to keep it consistent across the config You can have it be emailaddress too.</div><div><br></div><div style="color:rgb(0,0,0)">Then, in relying-party.xml:</div><div><br></div><div style="color:rgb(0,0,0)"><bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__JMU.maps.arcgis.com&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=uRQHxT7ztgm1zlQXb6QFDU_ZN9XDwURHDdKvUzKIS6Y&s=jCvnxi7VbGBYa7ymhnfLjq0zP9svWze4LTDiT_RRSQQ&e=" target="_blank">JMU.maps.arcgis.com</a>"></div><div style="color:rgb(0,0,0)"> <property name="profileConfigurations"></div><div style="color:rgb(0,0,0)"> <list></div><div style="color:rgb(0,0,0)"> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"/></div><div style="color:rgb(0,0,0)"><span style="white-space:pre-wrap"> </span><span style="white-space:pre-wrap"> </span></list></div><div style="color:rgb(0,0,0)"> </property></div><div><span style="color:rgb(0,0,0)"> </bean></span> </div><div> </div><div><br></div><div><br></div><div>Hope this snippet helps.</div><div><br></div><div> </div><br><span style="font-family:monospace;white-space:pre-wrap">--
Brandon McKean
IT / Systems
Linux Administrator </span><div><span style="font-family:monospace;white-space:pre-wrap"><a href="tel:%28540%29568-4235" value="+15405684235" target="_blank">(540)568-4235</a></span> </div><div><div><div><br></div><div>On Wed, 2015-07-15 at 15:54 -0400, Todd Vernick wrote:</div></div></div><blockquote type="cite"><div><div><div dir="ltr"><div><div><div><div><div>My SP requires the assertion:<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<br></div>or<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br><br></div>I used the following config to pass uid to pass this in shibboleth version 2<br><br></div>attribute_resolver.xml<br> <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid"><br> <resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/><br> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/><br> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/><br> </resolver:AttributeDefinition><br><br></div>relying_party.xml<br> <rp:RelyingParty<br> id="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=" target="_blank">http://fs.ultiproworkplace.com/adfs/services/trust</a>"<br> provider="<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__idp.squarespace.net_idp_shibboleth&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=dprgEtghorgyPqpdnAUkp5NDCYNM_jn2o9hUNVWtDMw&e=" target="_blank">https://idp.squarespace.net/idp/shibboleth</a>"<br> defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"<br> defaultSigningCredentialRef="IdPCredential"><br><rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"<br> includeAttributeStatement="true"<br> assertionLifetime="300000"<br> assertionProxyCount="0"<br> signResponses="conditional"<br> signAssertions="never"<br> signRequests="conditional"<br> encryptAssertions="never"<br> encryptNameIds="never"<br>/><br> </rp:RelyingParty><br><br><br></div><div>Version 3 carried over a different relying_party config<br> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=" target="_blank">http://fs.ultiproworkplace.com/adfs/services/trust</a>"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="SAML2.SSO" p:encryptAssertions="false" /><br> </list><br> </property><br> </bean><br><br></div><div>And I used the same attribute_resolver config for version 3.<br></div>When decoding the saml response, it's not showing a 1.1:nameid-format anymore, only 2.0 formats.</div>
</div></div><span><font color="#888888"><pre>--
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></pre></font></span></blockquote></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>
<pre>--
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></pre></blockquote></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>