<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Andy,</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Thank you very much. Adobe has insisted that the NameID format be "uspecified." I see yours is persistent: </div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><span style="font-family:arial,sans-serif;font-size:12.8000001907349px"><br></span></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><span style="font-family:arial,sans-serif;font-size:12.8000001907349px"> <resolver:AttributeDefinition xsi:type="ad:Simple" id="adobe-principal" sourceAttributeID="eduPersonPr</span><span style="font-family:arial,sans-serif;font-size:12.8000001907349px">incipalName"></span></div><span style="font-size:12.8000001907349px"> <resolver:Dependency ref="ONIDLDAP" /></span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px"> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameI</span><span style="font-size:12.8000001907349px">D" nameFormat="urn:oasis:names:tc</span><span style="font-size:12.8000001907349px">:SAML:2.0:nameid-format:persis</span><span style="font-size:12.8000001907349px">tent"/></span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px"> </resolver:AttributeDefinition</span><span style="font-size:12.8000001907349px">></span></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 31, 2015 at 1:16 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Sat, 29 Aug 2015, Kathy E. Wright wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I am trying to integrate our Shibboleth IdP 2.4 with Okta's SAML dashboard<br>
for Adobe.com. We can release eppn to them as a NameID but only in<br>
transient or persistent format. Adobe says the NameID needs to be<br>
"unspecified" and I haven't been able to get that working. Does anyone have<br>
a solution?<br>
</blockquote>
<br></span>
Kathy,<br>
<br>
Here is my IDP v2.4 configuration for Adobe/Okta:<br>
<br>
attribute-filter.xml:<br>
<br>
<!-- Adobe attributes --><br>
<afp:AttributeFilterPolicy id="adobe"><br>
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://www.okta.com/saml2/service-provider/spi1fhbo6hBnuyO5O0x7" rel="noreferrer" target="_blank">https://www.okta.com/saml2/service-provider/spi1fhbo6hBnuyO5O0x7</a>" /><br>
<afp:AttributeRule attributeID="transientId"><br>
<afp:DenyValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="adobe-principal"><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="adobe_firstname"><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="adobe_lastname"><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="adobe_email"><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
attribute-resolver.xml:<br>
<br>
<!-- Adobe NameID attribute --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="adobe-principal" sourceAttributeID="eduPersonPrincipalName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/><br>
</resolver:AttributeDefinition><br>
<br>
<!-- Adobe attributes --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="adobe_firstname" sourceAttributeID="givenName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="FirstName" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="adobe_lastname" sourceAttributeID="sn"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="LastName" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="adobe_email" sourceAttributeID="eduPersonPrincipalName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="Email" /><br>
</resolver:AttributeDefinition><br>
<br>
<br>
This configuration turns the EPPN into a Persistent NameID. In the SAML dashboard, we chose "Email Address" as the identifier and created users in Adobe using the EPPN value. The filter blocks the release of transientId, so that the adobe-principal is released instead.<br>
<br>
Let me know if you have any questions. I set this up just a week ago.<br>
<br>
Andy<div class="HOEnZb"><div class="h5"><br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<p><font face="verdana, sans-serif" size="2" style="font-size:small">Infrastructure & Ops<br></font><span style="font-family:verdana,sans-serif;font-size:small">Clemson University<br></span><span style="font-family:verdana,sans-serif;font-size:small">CCIT, 340 Computer Court<br></span><span style="font-family:verdana,sans-serif;font-size:small">Anderson, SC 29625<br></span><a href="mailto:kewrig@clemson.edu" style="color:rgb(17,85,204);font-size:small;font-family:verdana,sans-serif" target="_blank">kewrig@clemson.edu</a><br><span style="font-family:verdana,sans-serif;font-size:small">(864) 656-8133</span></p></div></div></div></div>
</div>