<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 26, 2016 at 2:35 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">> Also, this Attribute Definition is leftover from the v2 to v3 upgrade<br>
<br>
</span><span class="">>         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"<br>
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-<br>
> format:WindowsDomainQualifiedName" /><br>
<br>
</span>That constant is wrong. That constant is NOT about SAML version. It is defined in SAML 1.x and that is the constant. The above is undefined. That is the root of your mess.<br>
<span class=""><br></span></blockquote><div>Commented this and all other NameID formatters out the resolver.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">
> (2) Modified the saml-nameid.xml to generate the format:<br>
<br>
</span>Pick the V2 way or the V3 way. If you use the V3 way, there is no attribute encoder involved.<br>
<span class=""><br></span></blockquote><div><br></div><div>I decided to go with the V3 method.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span class=""><br>
> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-<br>
> format:WindowsDomainQualifiedName</NameIDFormat><br>
<br>
</span>And here you have the wrong constant, which doesn't match.<br>
<span class=""><font color="#888888"><br></font></span></blockquote><div><br></div><div>And returned the NameIDFormat line to </div><div><br></div><div><div><NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat><br></div></div><div> </div><div><br></div><div>Unfortunately, it's still dropping through to transient formatting:</div><div><br></div><div><div> <saml2:Subject></div><div>            <saml2:NameID</div><div>                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"</div><div>                NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>" SPNameQualifier="<a href="http://bucknell.maps.arcgis.com">bucknell.maps.arcgis.com</a>">AAdzZWNyZXQxzwuMlkEnBpBZ83uwehs32gAcJIEBDeVznWVXIYlpmAnl7zbv+WcWtkq2Sr0s/l51pRvXEe59LdR/+4ZcLoM3ArLc01u79MRKoxmQm9grGdqogKB6zg6+4WEO/MFvoc4=</saml2:NameID></div><div>            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div>                <saml2:SubjectConfirmationData Address="134.82.79.6"</div><div>                    InResponseTo="_MhLgXiDjbZZjVJkL"</div><div>                    NotOnOrAfter="2016-02-26T20:47:43.951Z" Recipient="<a href="https://bucknell.maps.arcgis.com/sharing/rest/oauth2/saml/signin">https://bucknell.maps.arcgis.com/sharing/rest/oauth2/saml/signin</a>"/></div><div>            </saml2:SubjectConfirmation></div><div>        </saml2:Subject></div></div><div><br></div><div><br></div><div>Based on what I've provided, should the nameid-format be set to WindowsDomainQualifiedName?</div><div><br></div><div>Thanks,</div><div>Mike</div><div><br></div></div></div></div>