<div dir="ltr"><div>We've been pulling our hair our with Adobe SSO --- why or why do they make life harder for all...</div><div><br></div><div>We have the following configure -- but for the life of me can't figure out why the NameID is not sent --- can anyone spot anything obvious we missed?<br></div><div><br></div><div><br></div><div>RELYING-PARTY.XML<br></div><div><bean parent="RelyingPartyByName" <br>                      c:relyingPartyIds="<a href="https://www.okta.com/saml2/service-provider/">https://www.okta.com/saml2/service-provider/</a>">           <br>            <property name="profileConfigurations"><br>                <list><br>                   <bean     parent="SAML2.SSO" <br>                               p:postAuthenticationFlows="#{{'touPweFlow','attribute-release'}}"<br>                                p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'}}" /> <br>                    <bean parent="SAML2.Logout" /><br>                </list><br>            </property><br>      </bean></div><div><br></div><div><br></div><div>ADOBE METADATA IMPORTED<br></div><div><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="https://www.okta.com/saml2/service-provider/">https://www.okta.com/saml2/service-provider/</a>"><br>       <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>          <md:KeyDescriptor use="signing"><br>             <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>                <ds:X509Data><br>                   <ds:X509Certificate><br>                           MIIC1zCCAkCgAwIBAgIGAWLZL1l6MA0GCSqGSIb3DQEBBQUAMIGuMQswCQYDVQQGEwJVUzETMBEG<br>                        A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU<br>                        MBIGA1UECwwLU1NPUHJvdmlkZXIxLzAtBgNVBAMMJmFkYmUtMDE2MzM2NzE1YWQ2ODFiYzBhNDk1<br>                        ZThhLTM2YjItcHJkMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE4MDQxODE0MzUy<br>                        MVoXDTI4MDQxODE0MzYyMVowga4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYw<br>                        FAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRl<br>                        cjEvMC0GA1UEAwwmYWRiZS0wMTYzMzY3MTVhZDY4MWJjMGE0OTVlOGEtMzZiMi1wcmQxHDAaBgkq<br>                        hkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMlj7W+L<br>                        G5bDisDrZopfTJR2FY1qNu2tZr45PSlnFElrRf2WfSw+2B75sqnxaeFNyLITk+9/Z7qD7k/wghhc<br>                        1TJHO3HVMJw8nNOAop9IKwmosc6URLZlKHUJQArbuT077GGL/sFAsx9GWpE4k34W7C6/t2/X/77v<br>                        HKnPwnO4+FwfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAg8CT/fSsoE5K3Nbddd13BkjMEUDmkeZB<br>                        1Ry8NbGeIp7UDWr3+Alqu9X+CzINzY4JH+iAAuYg/cuxKWvUCd+NJkX2NN/AWpH1aIqEfXD6MlzT<br>                        1Hv5NVyxILiWHo3NY0hO9lJsHrLD0vb+ziL/KjIDWANJNy35d7uN3zFq3H0aI6Y=<br>                    </ds:X509Certificate><br>                </ds:X509Data><br>             </ds:KeyInfo><br>          </md:KeyDescriptor><br>          <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br>          <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://adbe-016336715ad681bc0a495e8a-36b2-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-016336715ad681bc0a495e8a-36b2-prd.okta.com/auth/saml20/accauthlinktest</a>" index="0" isDefault="true" /><br>       </md:SPSSODescriptor><br>    </md:EntityDescriptor></div><div><br></div><div><br></div><div>SAML-NAMEID.XML</div><div><bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>            p:attributeSourceIds="#{ {'Email'} }" /></div><div><br></div><div><br></div><div>ATRIBUTE-FILTER.XML</div><div><br></div><div><AttributeFilterPolicy id="<a href="https://www.okta.com/saml2/service-provider/">https://www.okta.com/saml2/service-provider/</a>"><br>        <PolicyRequirementRule xsi:type="Requester"<br>                           value="<a href="https://www.okta.com/saml2/service-provider/">https://www.okta.com/saml2/service-provider/</a>"/><br>        <br>        <AttributeRule attributeID="FirstName"><br>            <PermitValueRule xsi:type="ANY" /><br>        </AttributeRule><br>        <br>        <AttributeRule attributeID="LastName"><br>            <PermitValueRule xsi:type="ANY" /><br>        </AttributeRule><br> <br>        <AttributeRule attributeID="Email"><br>            <PermitValueRule xsi:type="ANY" /><br>        </AttributeRule>  <br>             <br>    </AttributeFilterPolicy></div><div><br></div><div><br></div><div>ATTRIBUTE-RESOLVER.XML <br></div><div><resolver:AttributeDefinition id="Email" xsi:type="ad:Simple" sourceAttributeID="mail"><br>    <resolver:Dependency ref="myLDAP" /><br>    <resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="Email" encodeType="false" /><br></resolver:AttributeDefinition><br> <br><resolver:AttributeDefinition id="LastName" xsi:type="ad:Simple" sourceAttributeID="sn"><br>    <resolver:Dependency ref="myLDAP" /><br>    <resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="LastName" encodeType="false" /><br></resolver:AttributeDefinition><br> <br><resolver:AttributeDefinition id="FirstName" xsi:type="ad:Simple" sourceAttributeID="givenName"><br>    <resolver:Dependency ref="myLDAP" /><br><br>    <resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="FirstName" encodeType="false" /><br></resolver:AttributeDefinition><br></div><div><br></div><div><br></div></div>