<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1493156354815_18524"><span>Thanks Scott</span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Tuesday, April 25, 2017 5:06 PM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container"><div dir="ltr">On 4/25/17, 4:15 PM, "users on behalf of Mike Flynn" <<a shape="rect" ymailto="mailto:users-bounces@shibboleth.net" href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a shape="rect" ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br clear="none"><br clear="none">> I have a customer that is telling me this:<br clear="none">><br clear="none">> you need to change the supplier initiated SAML request to use:<br clear="none">> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br clear="none"><br clear="none">If they want to send you that Format, which is dumb to begin with, they're more than capable of doing it themselves.<div class="yqt1407475172" id="yqtfd11726"><br clear="none"><br clear="none">> I have about 2000 IDPs connected to me and I do not want to change anything to affect those folks. Is it possible to set a relying<br clear="none">> party rule or something to give these folks what they are asking for?</div><br clear="none"><br clear="none"><a shape="rect" href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingPartySettings" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingPartySettings</a><br clear="none"><br clear="none">As of 2.6 you can set NameIDFormat in one. But if you screw it up, you can break pretty much any IdP, so it's not something to mess with in production without testing it first. NameIDPolicy has mandatory semantics in SAML, an IdP can't ignore it.<br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none"><br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><div class="yqt1407475172" id="yqtfd67815"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>