<div dir="ltr">Scott, David and Jeff:<div><br></div><div>Thanks for your patience. I believe the formatting is now correct, I'm just having problems releasing the correct data.</div><div><br></div><div>Following the guides at <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier</a> and <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier</a>, I'm trying to a custom Name Identifier that release the email address of the authenticated user. To that end I've made the following config changes: In the resolver, I have the following</div><div><br></div><div><div> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail" sourceAttributeID="mail"></div><div> <resolver:Dependency ref="myLDAP" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div><div> <resolver:AttributeDefinition id="userEmail" xsi:type="ad:PrincipalName" sourceAttributeID="mail" ></div><div> <resolver:Dependency ref="mail" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>In the metadata for this particular SP, I do have the appropriate NameIDFormat specified:</div><div><br></div><div><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br></div><div><br></div><div><br></div><div>And I am releasing the attribute in the attribute-filter file:</div><div><br></div><div><div> <afp:AttributeFilterPolicy></div><div> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="benefitfocus.com:sp" /></div><div><br></div><div> <afp:AttributeRule attributeID="userEmail"></div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div> </afp:AttributeRule></div><div><br></div><div> </afp:AttributeFilterPolicy></div></div><div><br></div><div>My problem is that the NameID thats being returned to the SP is "dahlberg" when it should be "<a href="mailto:dahlberg@bucknell.edu">dahlberg@bucknell.edu</a>":</div><div><br></div><div><pre id="txt"> <saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>"
SPNameQualifier="benefitfocus.com:sp"
>dahlberg</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="172.20.10.105"
InResponseTo="b-sydCYHQXsqeRA_XjltoqcNrzA"
NotOnOrAfter="2015-10-01T16:10:21.921Z"
Recipient="<a href="https://testsp.benefitfocus.com/sp/ACS.saml2">https://testsp.benefitfocus.com/sp/ACS.saml2</a>"
/>
</saml2:SubjectConfirmation></pre><pre id="txt"><br></pre><pre id="txt"><font face="arial, helvetica, sans-serif">Any Idea where I'm going wrong?</font></pre><pre id="txt"><font face="arial, helvetica, sans-serif"><br></font></pre><pre id="txt"><font face="arial, helvetica, sans-serif">Thanks,</font></pre><pre id="txt"><font face="arial, helvetica, sans-serif">Mike</font></pre></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Sep 30, 2015 at 4:45 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 9/30/15, 4:26 PM, "users on behalf of Michael Dahlberg" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:olgamirth@gmail.com">olgamirth@gmail.com</a>> wrote:<br>
<br>
>Yes, my apologies. Of course, I am releasing that attribute in the attribute-filter.xml file:<br>
<br>
</span>I know, but that's got nothing to do with format selection. There are historical reasons why people conflate them, but they haven't been related in many, many years and there is nothing I mentioned to that does so. All you have to do is release the attribute involved, the rest is about format selection.<br>
<span class=""><br>
>I appreciate the description of a persistent identifier but I don't know how it is used, what it releases, or where it releases it in the SAML payload. I usually stop reading that particular page at that point. I agree, I should continue on.<br>
><br>
<br>
</span>The specific documentation section I pointed to doesn't say anything about any particular formats (aside from calling out the issue with "unspecified"), certainly not that one.<br>
<span class=""><br>
>I'm not sure how I would know that there "is not an e-mailAddress nameFormat unique to SAML 2.0" and what effect changing that nameFormat has on what is released, how it is released and where it is released..<br>
<br>
</span>If you want a book on SAML, that's not within my willingness to produce, not and still have a life. But the core standard is not that long and the section on NameID Formats is near the end and is very short. That's all that's defined. Email address happens to be one of the predefined formats.<br>
<span class=""><br>
>Given that I am releasing the cnIdentifiedName in the attribute-filter, that other attributes can be released without blocking the transientID, would there be any other reason why the transientID is released and not the cnIdentifiedName?<br>
<br>
</span>You can hack things into submission by blocking the release of transientId as an attribute for just that SP so that the total set of candidate NameIDs is down to one, the one you want. The *right* way is documented in what I sent, you either put the Format you want into the SP's metadata, or if that's not practical you put it into a RelyingParty override via nameIDFormatPrecedence.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>