<BR>
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I upgraded from v2.4 to v3.3. Everything seems to be working fine except for “unspecified” nameids. I am using Legacy Relyingparty configuration. I didn’t change anything much in relying party from V2 upgrade except for commenting out Metadata
provider and security trust engines.<o:p></o:p></p>
<p class="MsoNormal">How to solve the nameids unspeficied problem. While I contact the SPs to change the nameids format specified, I am afraid that cannot happen soon.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In idp-properties.log, it is ignoring the unspecified format and making that as transient.<o:p></o:p></p>
<p class="MsoNormal">2017-03-20 19:12:00,249 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
<p class="MsoNormal">2017-03-20 19:12:00,249 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified' format<o:p></o:p></p>
<p class="MsoNormal">2017-03-20 19:12:00,249 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:transient]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In services.properties : <o:p></o:p></p>
<p class="MsoNormal">idp.service.relyingparty.resources= shibboleth.LegacyRelyingPartyResolverResources<o:p></o:p></p>
<p class="MsoNormal">In saml-nameid.properties: <o:p></o:p></p>
<p class="MsoNormal">idp.nameid.saml2.legacyGenerator= shibboleth.LegacySAML2NameIDGenerator<o:p></o:p></p>
<p class="MsoNormal">idp.nameid.saml1.legacyGenerator= shibboleth.LegacySAML1NameIdentifierGenerator<o:p></o:p></p>
<p class="MsoNormal">Here is relying-party sample.<o:p></o:p></p>
<p class="MsoNormal"><rp:RelyingPartyGroup xmlns:rp="urn:mace:shibboleth:2.0:relying-party"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml" xmlns:metadata="urn:mace:shibboleth:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:resource="urn:mace:shibboleth:2.0:resource" xmlns:security="urn:mace:shibboleth:2.0:security"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml" xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<o:p></o:p></p>
<p class="MsoNormal"> xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party classpath:/schema/shibboleth-2.0-relying-party.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:relying-party:saml classpath:/schema/shibboleth-2.0-relying-party-saml.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:metadata classpath:/schema/shibboleth-2.0-metadata.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:resource classpath:/schema/shibboleth-2.0-resource.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:security:saml classpath:/schema/shibboleth-2.0-security-policy-saml.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:oasis:names:tc:SAML:2.0:metadata classpath:/schema/saml-schema-metadata-2.0.xsd"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <rp:AnonymousRelyingParty provider=<a href="https://shibboleth.xyz.edu/shibboleth-idp">https://shibboleth.xyz.edu/shibboleth-idp</a> defaultSigningCredentialRef="xyz_creds" /><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <rp:DefaultRelyingParty provider="https://shibboleth.xyz.edu/shibboleth-idp” defaultSigningCredentialRef="xyz_creds"><o:p></o:p></p>
<p class="MsoNormal"> <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" includeAttributeStatement="false" assertionLifetime="PT5M” signResponses="conditional" signAssertions="never" /><o:p></o:p></p>
<p class="MsoNormal"> …<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true" assertionLifetime="PT5M" assertionProxyCount="0" signResponses="never" signAssertions="always" encryptAssertions="conditional" encryptNameIds="never"
/><o:p></o:p></p>
<p class="MsoNormal"> </rp:DefaultRelyingParty><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><rp:RelyingParty id=<a href="https://xyz.abc.com">https://xyz.abc.com</a>” provider="https://shibboleth.xyz.edu/shibboleth-idp" defaultSigningCredentialRef="xyz_creds"><o:p></o:p></p>
<p class="MsoNormal"> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" signResponses="never" signAssertions="always" encryptNameIds="never" encryptAssertions="never" /><o:p></o:p></p>
<p class="MsoNormal"> <rp:ProfileConfiguration xsi:type=" saml:SAML2AttributeQueryProfile" signResponses="never" signAssertions="always" encryptNameIds="never" encryptAssertions="never" /><o:p></o:p></p>
<p class="MsoNormal"> <rp:ProfileConfiguration xsi:type=" saml:SAML2ArtifactResolutionProfile" signResponses="never" signAssertions="always" encryptNameIds="never" encryptAssertions="never" />
<o:p></o:p></p>
<p class="MsoNormal"> </rp:RelyingParty><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:blue"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<BR>