<div dir="ltr">If both <span style="font-size:12.8px">cnIdentifiedName and transientID are available encoded as NameID, the IdP is "choosing" the latter.</span><div><span style="font-size:12.8px"><br></span><div><span style="font-size:12.8px">You may need to adjust the attribute-filter.xml to not release transientID to the SP for which you want the subject to be </span><span style="font-size:12.8px">cnIdentifiedName.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Sep 30, 2015 at 11:53 AM, Michael Dahlberg <span dir="ltr"><<a href="mailto:olgamirth@gmail.com" target="_blank">olgamirth@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I thought I was getting an understanding of the NameID format and its encoding. Unfortunately, I think I'm incorrect.<div><br></div><div>I have the following configuration in the attribute-resolver.xml in a shib v. 2.4.0 IdP:</div><div><br></div><div><div> <resolver:AttributeDefinition id="cnIdentifiedName" xsi:type="ad:PrincipalName"></div><div> <resolver:Dependency ref="commonName" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>My reading of this is that when I release the attribute "cnIdentifiedName" that the "commonName" attribute retrieved from our LDAP server will be SAML2 encoded and released in the Subject NameID field. Unfortunately, this is the Subject of the SAML trace when I do that:</div><div><br></div><div><pre><saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth" target="_blank">https://shib.bucknell.edu/idp/shibboleth</a>"
SPNameQualifier="benefitfocus.com:sp"
>_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="172.20.10.105"
InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"
NotOnOrAfter="2015-09-30T19:35:21.055Z"
Recipient="<a href="https://testsp.benefitfocus.com/sp/ACS.saml2" target="_blank">https://testsp.benefitfocus.com/sp/ACS.saml2</a>"
/>
</saml2:SubjectConfirmation>
</saml2:Subject></pre><pre><br></pre><pre><font face="arial, helvetica, sans-serif">It looks as if the NameID is encoding the transientID. Any suggestions on how to correct this and release the commonName in an emailAddress format, SAML2 encoded, in the NameID?</font></pre><pre><font face="arial, helvetica, sans-serif"><br></font></pre><pre><font face="arial, helvetica, sans-serif">Thanks,</font></pre><pre><font face="arial, helvetica, sans-serif">Mike</font></pre></div><div><br></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>