<div dir="ltr"><div>I'm still having a bit of a problem returning an attribute encoded in the SAML2 Name Identifier ... thanks for your continued assistance.<br><br></div><div>I've made the following modifications:<br></div><div><br>In attribute-resolver.xml:<br><br>    <resolver:AttributeDefinition id="pageUp" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="cn"><br>        <resolver:Dependency ref="myLDAP" /><br>        <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>            nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent" /><br>    </resolver:AttributeDefinition><br><br></div><div>The cn attribute is one that is released by the data connector referenced in myLDAP and contains the username of the authenticated user<br></div><div><br>In attribute-filter.xml:<br><br>    <afp:AttributeFilterPolicy><br>        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://admin.dc4.pageuppeople.com/">https://admin.dc4.pageuppeople.com/</a>" /><br><br>        <afp:AttributeRule attributeID="pageUp"><br>            <afp:PermitValueRule xsi:type="basic:ANY" /><br>        </afp:AttributeRule><br><br>    </afp:AttributeFilterPolicy><br><br></div><div>Seems pretty basic once you comprehend what a Name Identifier is (I'm still learning that myself)<br></div><div><br></div>However, a SAML tracer result shows the following (I've just included the SAML2 subject for clarification):<br><div><br><pre id="txt">        <saml2:Subject>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                          NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>"
                          SPNameQualifier="<a href="https://admin.dc4.pageuppeople.com/">https://admin.dc4.pageuppeople.com/</a>"
                          >_5ea915fd003b7acdf9f65283fd288073</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.20.10.105"
                                               InResponseTo="_9a2bb99d-6198-4c25-b8b9-f9c2794dc69a"
                                               NotOnOrAfter="2015-08-19T13:23:47.460Z"
                                               Recipient="<a href="https://admin.dc4.pageuppeople.com//gateway/SAML.aspx?binding=urn%3aoasis%3anames%3atc%3aSAML%3a2.0%3abindings%3aHTTP-POST">https://admin.dc4.pageuppeople.com//gateway/SAML.aspx?binding=urn%3aoasis%3anames%3atc%3aSAML%3a2.0%3abindings%3aHTTP-POST</a>"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject></pre>It looks as if the NameID value is the transientId, not the cn.  I have no idea why the transientId is returned rather than the cn from the configurations listed above.<br><br></div><div>Any suggestions will be appreciated.  Also, if you feel so inclined to point out my terminology mistakes, I would appreciate that as well ... being able to accurately describe the problem is 75% of the battle.<br><br></div><div>Thanks,<br></div><div>Mike<br></div></div>