<div dir="ltr">I'm currently working on upgrading our IdP from v2 to v3, doing a migration wherever possible.  I currently have an almost completely functioning Shibboleth v3 implementation.  My only sticking point seems to be in generating a custom NameID format for SAML2 encoding.  Generating a SAML1 encoded NameIdentifier using an email address as the SourceID worked without having to make any modification to the config files brought over from the upgrade process.<div><br></div><div>I've been following the documentation in <a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a>.  The particular identifier that I want to release is the WindowsDomainQualifiedName and the SourceID is the sAMAccountName (I can see from the logs that this attribute is being correctly retrieved from our AD server). </div><div><br></div><div>(1) I've modified the attribute-filter.xml file to release the attribute:</div><div><br></div><div><div>    <!-- Release the NameID to <a href="http://bucknell.maps.arcgis.com">bucknell.maps.arcgis.com</a> --></div><div>    <afp:AttributeFilterPolicy></div><div>        <afp:PolicyRequirementRule xsi:type="basic:OR"></div><div>            <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="http://bucknell.maps.arcgis.com">bucknell.maps.arcgis.com</a>" /></div><div>            <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="http://tbucknell.maps.arcgis.com">tbucknell.maps.arcgis.com</a>" /></div><div>        </afp:PolicyRequirementRule></div><div><br></div><div>        <afp:AttributeRule attributeID="transientId"></div><div>            <afp:DenyValueRule xsi:type="basic:ANY"/></div><div>        </afp:AttributeRule></div><div><br></div><div>        <afp:AttributeRule attributeID="WindowsDomainQualifiedName"></div><div>            <afp:PermitValueRule xsi:type="basic:ANY"/></div><div>        </afp:AttributeRule></div><div><br></div><div>     </afp:AttributeFilterPolicy></div></div><div><br></div><div>Also, this Attribute Definition is leftover from the v2 to v3 upgrade</div><div><br></div><div><div>    <resolver:AttributeDefinition id="WindowsDomainQualifiedName" xsi:type="ad:PrincipalName"></div><div>        <resolver:Dependency ref="staticAttributes" /></div><div>        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat=" </div><div>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName" nameQualifier="dc=bucknell,dc=edu" /></div><div>        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName" /></div><div>    </resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>(2) Modified the saml-nameid.xml to generate the format:</div><div><br></div><div><div>    <util:list id="shibboleth.SAML2NameIDGenerators"></div><div><br></div><div>        <ref bean="shibboleth.SAML2TransientGenerator" /></div><div><br></div><div>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br></div><div>            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName"</div><div>            p:attributeSourceIds="#{ {'sAMAccountName'} }" /></div><div><br></div><div>    </util:list></div></div><div><br></div><div>As an aside, why shouldn't the SAML2 encoding format be </div><div><br></div><div>p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName"<br></div><div><br></div><div>Changing it to this does not modify the behavior.  Also, the format for emailAddress also use 1.1 encoding.</div><div><br></div><div>(3) and finally triggered this format selection by incorporating this line into the metadata for the SP:</div><div><br></div><div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="http://bucknell.maps.arcgis.com">bucknell.maps.arcgis.com</a>"></div><div>        <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName</NameIDFormat></div></div><div><br></div><div>The log file shows that it keeps releasing the NameID in the transient format:</div><div><br></div><div><div>        <saml2:Subject></div><div>            <saml2:NameID</div><div>                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"</div><div>                NameQualifier="<a href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>" SPNameQualifier="<a href="http://bucknell.maps.arcgis.com">bucknell.maps.arcgis.com</a>">AAdzZWNyZXQxJ8SE/evGHKpIbxparIGMSC5TQgqgAm5etE/QmnVQikI0OrTOtUfiytkBIuoWourAnK+0VC7guAshoZDZvgr13mTzBl1AgYAalTfvvejxKC7KAM/SKkKCXYktlz5QVco=</saml2:NameID></div><div>            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div>                <saml2:SubjectConfirmationData Address="134.82.79.6"</div><div>                    InResponseTo="_PBTcZueiHJrhfdXa"</div><div>                    NotOnOrAfter="2016-02-26T19:06:46.651Z" Recipient="<a href="https://bucknell.maps.arcgis.com/sharing/rest/oauth2/saml/signin">https://bucknell.maps.arcgis.com/sharing/rest/oauth2/saml/signin</a>"/></div><div>            </saml2:SubjectConfirmation></div><div>        </saml2:Subject></div></div><div><br></div><div>Am I missing any config changes that need to be incorporated?  Why does the transient format continue to be selected despite denying it in the filter and specifying a different format in the metadata?</div><div><br></div><div>Thanks,</div><div>Mike</div></div>