<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1454421906039_89098" dir="ltr">I have not doubt that I'm misunderstanding, documentation seems very incomplete so I'm struggling through this at every step. <br></div><div id="yui_3_16_0_1_1454421906039_89191" dir="ltr"><br></div><div id="yui_3_16_0_1_1454421906039_89192" dir="ltr">Ok, so how do I do this? The vendor is using NameID and wants it to be unique, they're recommending it be the email address. This suggests that I can override NameID per SP, if so, how do I do this?</div><div dir="ltr"><br></div><div dir="ltr">Thanks</div><div id="yui_3_16_0_1_1454421906039_89311" dir="ltr">-Bob<br></div><div id="yui_3_16_0_1_1454421906039_88797"><span></span>--<br></div><div id="yui_3_16_0_1_1454421906039_88792">Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> On Tuesday, February 2, 2016 4:26 PM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container">> I'm new to shib so my understanding is evolving by the hour, so if I make<br clear="none">> no sense with my questions please bear with me.<br clear="none"><br clear="none">You're making a very common error, so don't be offended when the response is that you're completely misunderstanding what you're seeing.<br clear="none"><br clear="none">> I'm having a problem authenticating to an SP who's service we've<br clear="none">> contracted. When I had idp.encryption.optional set to false, we got the error<br clear="none">> SAML failed to login, Status code is<br clear="none">> urn:oasis:names:tc:SAML:2.0:status:Responder. When it is supposed to be<br clear="none">> urn:oasis:names:tc:SAML:2.0:status:Success<br clear="none"><br clear="none">If the SP doesn't have a key, you can't do XML encryption. You can either use that optional flag or explicitly disable encryption for that relying party with an override in relying-party.xml<br clear="none"><br clear="none">This has nothing to do with NameIDs in any way.<br clear="none"><br clear="none">> When I set idp.encryption.optional to true I can authenticate against my<br clear="none">> Shib server but then it looks like NameID is coming through encrypted.<br clear="none"><br clear="none">No. That's a transientID, it's opaque. There are two ways to generate them. Both are opaque. Neither are encrypted in the sense you're thinking about. They are only used to provide a handle to an SP for making logout requests.<br clear="none"><br clear="none">If an SP requires a NameID in a different form, then you can't use transient. That still has nothing to do with encryption, or with the property you're looking at.<div class="yqt8242533196" id="yqtfd57069"><br clear="none"><br clear="none">> Based on some reading I've done it appears that NameID is encrypted if end<br clear="none">> to end encryption can't be assured,</div><br clear="none"><br clear="none">It is not. The assertion would be encrypted, not the NameID alone, and it can't be because there's no key in the metadata, or it would be working.<br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none"><br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><div class="yqt8242533196" id="yqtfd81961"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>