<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""> Thanks for the response, Scott. </div><div class=""><br class=""></div><div class=""> So do I NEED to do something about NameID on the SP side, or can I ignore this information that I’ve been given? I assumed that was the problem when I hit the test page, it redirected me to the IdP, but the below error came back. I went through the basic configuration, and didn’t see anything about NameID, and when I peviously set up a different application using Weblogic as the SP I don’t remember needing to do anything with NameID. </div><div class=""><br class=""></div><div class=""> Error that Im getting back from IdP from test page .. </div><div class=""><br class=""></div><div class=""><div class="">opensaml::FatalProfileException at (<a href="https://hostname.com/Shibboleth.sso/SAML2/POST" class="">https://hostname.com/Shibboleth.sso/SAML2/POST</a>)</div><div class=""><br class=""></div><div class="">SAML response reported an IdP error.</div><div class=""><br class=""></div><div class="">Error from identity provider:</div><div class=""><br class=""></div><div class="">Status: urn:oasis:names:tc:SAML:2.0:status:Responder</div></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">Adam von Nieda</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><a href="mailto:Adam@vonNieda.org" class="">Adam@vonNieda.org</a></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Jun 8, 2017, at 10:31 AM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class=""> Hi folks, I’m running Shibboleth SP 2.6.0 on Linux / Apache .<br class=""><br class=""> I’ve been given a “NameID” of “SAMAccountName” from my ADFS<br class="">administrator, SAML2.0.<br class=""></blockquote><br class="">That isn't valid, SAML NameID Formats are URIs. So that should be fixed. That notwithstanding,<br class=""><br class=""><blockquote type="cite" class="">From what I can tell from the Wiki, this goes in the<br class="">attribute-map.xml? I’m new to this and don’t quite understand what I need<br class="">to add to make this happen. That’s really all I’ve been given, outside of the<br class="">federationmetadata.xml. So hopefully that’s all I need from them.<br class=""></blockquote><br class="">Well, you shouldn't accept it without establishing an appropriately unique Format, but if you choose to map it, yes, you create an Attribute rule and set the name to the value in the Format of the NameID you want to pull in.<br class=""><br class="">Identifiers are not a simple matter. As the application owner, you need to deeply understand your requirements and how that would impact federating an application to know what kind of identifier(s) you should be prepared to accept. Whether that includes the kind of things people put in their AD's samAccountName field is not something I can say.<br class=""><br class="">-- Scott<br class=""><br class="">-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br class=""></body></html>