<div dir="ltr">Scott, <div> That worked until I did this</div><div><br></div><div><div> <afp:AttributeFilterPolicy id="wheniwork"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><PolicyRequirementRule xsi:type="Requester" value="<a href="https://saml.wheniwork.com/682879">https://saml.wheniwork.com/682879</a>" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><AttributeRule attributeID="firstName"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><PermitValueRule xsi:type="basic:ANY" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></AttributeRule></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><AttributeRule attributeID="lastName"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><PermitValueRule xsi:type="basic:ANY" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></AttributeRule></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><AttributeRule attributeID="mail"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><PermitValueRule xsi:type="basic:ANY" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></AttributeRule></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><AttributeRule attributeID="eduPersonPrincipalName"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><PermitValueRule xsi:type="basic:ANY" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></AttributeRule></div><div> </afp:AttributeFilterPolicy></div></div><div><br></div><div><br></div><div>to set up the restriction. Now it seems that this brings back this error. I did some digging around and tried adding this to the saml-nameid.xml file</div><div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:omitQualifiers="true"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> p:attributeSourceIds="#{ {'mail'} }"></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <property name="activationCondition"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://saml.wheniwork.com/682879">https://saml.wheniwork.com/682879</a>" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> </property></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></bean></div></div><div><br></div><div>but doesn't seem to fix the issue. Thoughts ????</div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Jun 21, 2017 at 12:37 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 6/21/17, 12:23 PM, "users on behalf of Richard Genthner" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:richard@guthnur.net" target="_blank">richard@guthnur.net</a>> wrote:<br>
<br>
> Has anyone used Shibboleth IDP 3 and the onelogin PHP SAML Library? We are trying to get it working for requesting the email<br>
> attribute with the formatting of urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress but i'm getting this in the logs:<br>
<br>
Then you didn't configure the IdP to support that Format. (*)<br>
<br>
See the docs under NameID Generation, subtopic on custom formats.<br>
<br>
-- Scott<br>
<br>
(*) Taken as given: never identify users by e-mail address, if you do need the address use the standards-defined "mail" attribute, and never use the NameID other than with the transient Format.<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>