<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi</p>
<p>I want to use the <b>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress </b>
NameIDFormat.</p>
<p>This is my idp configuration<br>
</p>
<p><u>idp-metadata.xml</u></p>
<p><NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat></p>
<p><u>attribute-resolver.xml</u><br>
</p>
<p><resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><br>
</resolver:AttributeDefinition><br>
<br>
</p>
<p><u>attribute-filter.xml</u></p>
<p> <AttributeRule attributeID="mail"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule></p>
<p><u>saml-nameid.xml</u></p>
<p> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
</p>
<p><u>accli command line test</u><br>
</p>
<p><br>
{<br>
"requester": <a class="moz-txt-link-rfc2396E" href="https://sp.whatever/shibboleth">
"https://sp.whatever/shibboleth"</a>,<br>
"principal": "p.brunmayr",<br>
"attributes": [<br>
<br>
<br>
{<br>
"name": "uid",<br>
"values": [<br>
"StringAttributeValue{value=p.brunmayr}" ]<br>
}, <br>
<br>
{<br>
"name": "mail",<br>
"values": [<br>
<a class="moz-txt-link-rfc2396E" href="mailto:StringAttributeValue{value=p.brunmayr@foobar.at}">
"StringAttributeValue{value=p.brunmayr@foobar.at}"</a> ]<br>
} <br>
<br>
]<br>
}<br>
<br>
When i test my sp against the idp i can log in and everything works fine. Inspecting the log for the NameId generation tells me</p>
<p>2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects<br>
2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<br>
2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: []<br>
2016-08-04 08:44:55,763 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: []<br>
2016-08-04 08:44:55,763 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:110] - No formats specified in configuration or in metadata, returning default<br>
2016-08-04 08:44:55,763 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:transient]<br>
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient<br>
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient<br>
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty<br>
</p>
<p>By the way i have no support for urn:oasis:names:tc:SAML:2.0:nameid-format:transient but it seems its from
<b>idp.nameid.saml2.default </b>setting.</p>
<p>But when i set on the SP side like this<br>
</p>
<p><SSO NameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" entityID=<a class="moz-txt-link-rfc2396E" href="https://sso.whatever/idp">"https://sso.whatever/idp"</a>><br>
SAML2<br>
</SSO><br>
</p>
<p>i get</p>
<p>2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects<br>
2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile Action AddNameIDToSubjects: Request specified NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,887 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,887 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,889 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197] - Checking for source attribute mail<br>
2016-08-04 09:27:02,889 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:216] - Generating NameID from String-valued attribute mail<br>
2016-08-04 09:27:02,890 - DEBUG [org.opensaml.saml.saml2.profile.AbstractSAML2NameIDGenerator:96] - Generating NameID
<a class="moz-txt-link-abbreviated" href="mailto:p.brunmayr@foobar.at">p.brunmayr@foobar.at</a> with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118] - Successfully generated identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:400] - Profile Action AddNameIDToSubjects: Successfully generated NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:358] - Profile Action AddNameIDToSubjects: Added NameID to 1 assertion subject(s)<br>
<br>
</p>
<p>Does the idp always use the <b>idp.nameid.saml2.default</b> settings when no samlp:NameIDPolicy is present ? Why does he not check the supportted NameIDFormat elements in idp.metadata.xml. Who is responsible for selecting the<br>
format ?</p>
<p><br>
</p>
<p>Thx<br>
</p>
<p><br>
</p>
<p><br>
</p>
<br>
<span style="FONT-SIZE: 10pt"><font size="2" face="Arial">
<p style="margin-top: 10px"> </p>
<span style="FONT-SIZE: 10pt">
<div style="border-top: 1px dashed #808080; border-bottom: 1px dashed #808080"><font size="3"><span style="FONT-SIZE: 12pt"><font color="gray" size="2" face="Courier New">LINZ AG für Energie, Telekommunikation, Verkehr und Kommunale Dienste<br>
A-4021 Linz, Wiener Straße 151, Postfach 1300, Tel. +43/732/3400-0, E-Mail: info@linzag.at</font></span></font></div>
</span>
<p style="margin-top: 10px"> </p>
<div></div>
</font></span>
</body>
</html>