<div dir="ltr">I thought I was getting an understanding of the NameID format and its encoding.  Unfortunately, I think I'm incorrect.<div><br></div><div>I have the following configuration in the attribute-resolver.xml in a shib v. 2.4.0 IdP:</div><div><br></div><div><div> <resolver:AttributeDefinition id="cnIdentifiedName" xsi:type="ad:PrincipalName"></div><div>        <resolver:Dependency ref="commonName" /></div><div>        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div>        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" /></div><div>    </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>My reading of this is that when I release the attribute "cnIdentifiedName" that the "commonName" attribute retrieved from our LDAP server will be SAML2 encoded and released in the Subject NameID field.  Unfortunately, this is the Subject of the SAML trace when I do that:</div><div><br></div><div><pre id="txt"><saml2:Subject>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                          NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>"
                          SPNameQualifier="benefitfocus.com:sp"
                          >_05ca010ec7535a474066fa5716fd5fda</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.20.10.105"
                                               InResponseTo="E0mTwqAn.LHkVh.j2VqFfWvm7rB"
                                               NotOnOrAfter="2015-09-30T19:35:21.055Z"
                                               Recipient="<a href="https://testsp.benefitfocus.com/sp/ACS.saml2">https://testsp.benefitfocus.com/sp/ACS.saml2</a>"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject></pre><pre id="txt"><br></pre><pre id="txt"><font face="arial, helvetica, sans-serif">It looks as if the NameID is encoding the transientID.  Any suggestions on how to correct this and release the commonName in an emailAddress format, SAML2 encoded, in the NameID?</font></pre><pre id="txt"><font face="arial, helvetica, sans-serif"><br></font></pre><pre id="txt"><font face="arial, helvetica, sans-serif">Thanks,</font></pre><pre id="txt"><font face="arial, helvetica, sans-serif">Mike</font></pre></div><div><br></div></div>