<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi guys, thanks to you I have done some steps forward.</div><div><br></div><div>Could you help me understand how the IdP manages the following related case to get NameID in format of emailAddress:</div><div>1) SP metadata includes <br></div><div>      <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><br>      <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br></div><div>2) authnrequest doesn't include any NameIDPolicy records <br></div><div>3) AttributeResolver&Filter provide 'mail' (urn:oid:0.9.2342.19200300.100.1.3)<br></div><div><br></div>Is next step to modify saml-nameid.xml in the following way? <br></div><div dir="ltr"><br></div><div dir="ltr"><util:list id="shibboleth.SAML2NameIDGenerators"><br>    <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>      p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>      p:attributeSourceIds="#{ {'mail'} }"><br> <br>      <property name="activationCondition"><br>          <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="IAMShowcase" /><br>      </property><br>    </bean><br></util:list><br></div><div><br></div><div>And relying-party.xml in the following way? (As the request doesn't include 
NameIDPolicy)<br><div dir="ltr">    <util:list id="shibboleth.RelyingPartyOverrides"><br>        <bean parent="RelyingPartyByName" c:relyingPartyIds="IAMShowcase"><br>            <property name="profileConfigurations"><br>                <list><br>                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br>                </list><br>            </property><br>        </bean>        <br>    </util:list><br><br></div>

</div>Is there any way to automate the behavior using information about 
NameIDFormat

presented in metadata and exclude 2 last steps?<br></div><div dir="ltr"><div> </div><div>Thanks,</div><div>Jake<br></div></div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 16 Apr 2019 at 19:35, Andrew Morgan <<a href="mailto:morgan@orst.edu">morgan@orst.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 16 Apr 2019, Yakov Revyakin wrote:<br>
<br>
> I ask you push me somehow to understand a roadmap:<br>
> 1) How to make Shib IdP and metadata-*less *SP friends?<br>
<br>
As others have said, you just create a metadata file by inserting the <br>
entityID and ACS URL of the SP.  The IDP operates from metadata, so you'll <br>
need to make metadata somehow.<br>
<br>
> 2) How to force the IdP to return the user name inside NameID tag with<br>
> NameIDFormat set to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<br>
<br>
This wiki page explains it:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a><br>
<br>
Here is a sample for saml-nameid.xml you might be able to use:<br>
<br>
   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br>
       p:attributeSourceIds="#{ {'uid'} }"><br>
       <property name="activationCondition"><br>
           <bean parent="shibboleth.Conditions.OR"><br>
               <constructor-arg><br>
                   <list><br>
                       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://sp1" rel="noreferrer" target="_blank">https://sp1</a>" /><br>
                       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://sp2" rel="noreferrer" target="_blank">https://sp2</a>" /><br>
                   </list><br>
               </constructor-arg><br>
           </bean><br>
       </property><br>
   </bean><br>
<br>
This will generate an "unspecified" format NameID from the "uid" attribute <br>
for an SP with entityID of "<a href="https://sp1" rel="noreferrer" target="_blank">https://sp1</a>" or "<a href="https://sp2" rel="noreferrer" target="_blank">https://sp2</a>".<br>
<br>
You will also need to add an override to relying-party.xml to force the <br>
use of the "unspecified" NameID for these SPs.  That is documented at the <br>
bottom of the wiki page.<br>
<br>
Thanks,<br>
        Andy<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>