<div dir="ltr">Thanks Scott, <br><br>Just to clarify, what do you meant by 'You'd have to release uid to that SP' ? <br>You meant pass urn value of uid as NameID format? <br><br>basically for this SP, SP only needs uid in subject (via NameID) with format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified <br><br>Does not require anything in attribute section.... <br><br>or also do we have examples on how to configure the generator to achieve it? <br><br>It looks like, needs to configure more things than listed below URL(section on unspecified) to pass below format , any other reference will be helpful <br>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified <br><br><a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith" rel="nofollow"><font color="#0066cc">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith</font></a><br><br><br>Thanks </div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 7, 2017 at 4:31 PM, Lalith Jayaweera <span dir="ltr"><<a href="mailto:ljayaweera@gmail.com" target="_blank">ljayaweera@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi, <br><br>For some existing vendors I need to still support <br> urn:oasis:names:tc:SAML:1.1:n<wbr>ameid-format:unspecified  unfortunately... <br><br>during my migration to IdP 3.2.x I followed below doc to achieve above need but with no luck <br><br><a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith" target="_blank" rel="nofollow">https://wiki.shibboleth.net/co<wbr>nfluence/display/IDP30/CustomN<wbr>ameIDGenerationConfiguration#C<wbr>ustomNameIDGenerationConfigura<wbr>tion-Dealingwith</a><br><br>Given no deny rules for transient ID like 2.x I did below in IdP 3.x, please let me know whether it is correct <br><br>in the saml-nameid.xml <br><br> <bean parent="shibboleth.SAML2Attrib<wbr>uteSourcedGenerator" <br>                 p:format="urn:oasis:names:tc:<wbr>SAML:1.1:nameid-format:unspeci<wbr>fied" <br>              p:attributeSourceIds="#{ {'uid'} }"><br>        <property name="activationCondition"><br>        <bean parent="shibboleth.Conditions.<wbr>RelyingPartyId" c:candidates="#{{'<a href="https://mytestsp.com/samlLogin%27" target="_blank" rel="nofollow">https://myte<wbr>stsp.com/samlLogin'</a>}}" /><br>        </property><br>       </bean><br><br><br>and in relying party .xml I got below <br><br><bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://mytestsp.com/samlLogin%22%3E" target="_blank" rel="nofollow">https://myt<wbr>estsp.com/samlLogin"></a><br>            <property name="profileConfigurations"><br>                <list><br><br>        <bean parent="SAML2.SSO" p:encryptAssertions="false"  p:signAssertions="true" p:signResponses="false"  p:nameIDFormatPrecedence="urn:<wbr>oasis:names:tc:SAML:1.1:nameid<wbr>-format:unspecified"  /><br>                <br>                </list><br>            </property><br>        </bean><br><br><br>but However in the SAML response I cannot see any NameID getting past from  IdP, if I remove above p:nameIDFormatPrecedence, I can see the  transientId getting passed for the NameID. <br><br>Can you advice, do I have to do any other config change to achieve above</div>
</blockquote></div><br></div>