<div dir="ltr">Well, I ended up editing their metadata, eliminating the "unspecified" line, and changing the 'request format email' line to have the urn:oid for the uid attribute, which is what we're passing. <div><br></div><div><div><b><md:NameIDFormat>urn:oid:0.9.2342.19200300.100.1.1</md:NameIDFormat></b> </div><div><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat> </div><div><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat> </div><div><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat> </div><div><br></div><div><br></div><div>Then I put this in saml-nameid.xml:</div><div><br></div><div><div> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div> p:format="urn:oid:0.9.2342.19200300.100.1.1"</div><div> p:attributeSourceIds="#{ {'uid', 'UDC_IDENTIFIER'} }" /></div></div><div><br></div><div>It's definitely generating the NameID using the uid format, but the only thing I'm not sure about is the UDC_IDENTIFIER name coming across. I mean, I have it in the attribute-resolver with source attribute of uid, I have it in their section of the attribute filter - and I see it in the assertion - but we still get this error when trying to log in:</div><div><br></div><div><span style="color:rgb(255,0,0);font-family:calibri,sans-serif;font-size:12px;font-weight:bold">com.ellucian.sso.exception.ApplicationException: UDC Id not available</span><br></div><div class="gmail_extra"><br><div class="gmail_quote">The instructions for getting this thing talking to an external IdP aren't abundantly clear, since they have their own IdP and have just started supporting talking to someone else's. (In fact, their syntax for how to return "UDC_IDENTIFIER" with another attribute as a source were just plain wrong.) So if anyone has got this working - especially knowing what magic parameters to use in the ssomanager configuration - I would appreciate your advice.<br></div><div class="gmail_quote"><br></div><div class="gmail_quote">I'm attaching the assertion produced by aacli as well as a log excerpt, if anyone has the time or inclination to help. </div><div class="gmail_quote"><br></div><div class="gmail_quote">Thank you! </div><div class="gmail_quote"><br></div><div class="gmail_quote">Karla B</div><div class="gmail_quote"><br></div><div class="gmail_quote">On Thu, Feb 25, 2016 at 1:35 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">* Karla Borecky <<a href="mailto:kborecky@smith.edu">kborecky@smith.edu</a>> [2016-02-25 19:31]:<br>
<span class="">> Now to tackle their desire to have a NameIDFormat of "unspecified." :-P<br>
<br>
</span>I think Scott's current advise here is to first try sending some less<br>
ill-defined format (with comparabe/compatible values as agreed upon)<br>
without telling them, to see how specific they are in their<br>
requirement for "unspecified".<br>
Certainly makes sense to me, even though it won't always work.<br>
<span class=""><font color="#888888">-peter<br>
</font></span><div class=""><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div style="margin-left:40px">Karla Borecky<br>Systems Administrator<br>ITS<br>Smith College<br>Northampton, MA 01063<br></div></div>
</div></div></div>