<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>At a minimum you will need to update your attribute-filter as well, otherwise Shibboleth will continue to use a name identifier for which there is a release policy. That may be the step you are missing. <br>
</p>
<p><br>
</p>
<p>See the very last part of the wiki page on custom name identifiers:<br>
</p>
<p><br>
</p>
<p><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier</a><br>
</p>
<p><br>
</p>
<p>It's probably also worth noting that there is not an e-mailAddress nameFormat unique to SAML 2.0, so your third line below should still reference the 1.1 emailAddress name format type:<br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div>
<div><br>
<br>
</div>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Michael Dahlberg <olgamirth@gmail.com><br>
<b>Sent:</b> Wednesday, September 30, 2015 3:53 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> NameID Format</font>
<div> </div>
</div>
<div>
<div dir="ltr">I thought I was getting an understanding of the NameID format and its encoding. Unfortunately, I think I'm incorrect.
<div><br>
</div>
<div>I have the following configuration in the attribute-resolver.xml in a shib v. 2.4.0 IdP:</div>
<div><br>
</div>
<div>
<div> <resolver:AttributeDefinition id="cnIdentifiedName" xsi:type="ad:PrincipalName"></div>
<div> <resolver:Dependency ref="commonName" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" /></div>
<div> </resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>My reading of this is that when I release the attribute "cnIdentifiedName" that the "commonName" attribute retrieved from our LDAP server will be SAML2 encoded and released in the Subject NameID field. Unfortunately, this is the Subject of the SAML trace
when I do that:</div>
<div><br>
</div>
<div>
<pre id="txt"><saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>"
SPNameQualifier="benefitfocus.com:sp"
>_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="172.20.10.105"
InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"
NotOnOrAfter="2015-09-30T19:35:21.055Z"
Recipient="<a href="https://testsp.benefitfocus.com/sp/ACS.saml2">https://testsp.benefitfocus.com/sp/ACS.saml2</a>"
/>
</saml2:SubjectConfirmation>
</saml2:Subject></pre>
<pre id="txt"><br></pre>
<pre id="txt"><font face="arial, helvetica, sans-serif">It looks as if the NameID is encoding the transientID. Any suggestions on how to correct this and release the commonName in an emailAddress format, SAML2 encoded, in the NameID?</font></pre>
<pre id="txt"><font face="arial, helvetica, sans-serif"><br></font></pre>
<pre id="txt"><font face="arial, helvetica, sans-serif">Thanks,</font></pre>
<pre id="txt"><font face="arial, helvetica, sans-serif">Mike</font></pre>
</div>
<div><br>
</div>
</div>
</div>
</div>
</body>
</html>