<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div>I have set setup SSO for couple of applications where the SP requires  Subject NameID format to be Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div><div><br></div><div>I'm able to do this successfully only if I release a specific attribute that's defined in my attribute-resolver.xml  as "user_id"   e.g.</div><div><br></div><div><div>   <resolver:AttributeDefinition xsi:type="ad:Template" id="user_id"></div><div>    <resolver:Dependency ref="myLDAP" /></div><div>    <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div>    <ad:SourceAttribute>mail</ad:SourceAttribute></div><div></resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>The part I don't understand is this I have at least 2 other attributes definitions in the attribute-resolver.xml that do not work if I release them instead,  such as the attribute "frshid"</div><div><br></div><div><div><resolver:AttributeDefinition xsi:type="ad:Template" id="frshid"></div><div>    <resolver:Dependency ref="myLDAP" /></div><div>    <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div><div>    <ad:SourceAttribute>mail</ad:SourceAttribute></div><div></resolver:AttributeDefinition></div></div><div><br></div><div><br></div><div>Here a snippet of the Subject from a SAML trace when it works releasing the attribute "user_id"</div><div><br></div><div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                  </span><saml2:Subject></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                          </span><saml2:NameID Format="<span style="background-color:rgb(255,255,0)">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</span>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                          </span>              NameQualifier="<a href="https://idp.pima.edu/idp/shibboleth">https://idp.pima.edu/idp/shibboleth</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                             </span>              SPNameQualifier="<a href="https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7">https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                         </span>              ><span style="background-color:rgb(255,255,0)"><a href="mailto:trename01@pima.edu">trename01@pima.edu</a></span></saml2:NameID></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                              </span><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                             </span><saml2:SubjectConfirmationData Address="144.90.132.76"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                            </span>                               InResponseTo="id191289947414822031926171130"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                           </span>                               NotOnOrAfter="2019-11-05T16:09:32.123Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                                </span>                               Recipient="<a href="https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                                </span>                               /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                            </span></saml2:SubjectConfirmation></div></div><div><br></div><div><br></div><div>Here's a snippet of the Subject from a SAML trace when it doesn't work releasing the attribute "frshid".</div><div><br></div><div><br></div><div><br></div><div><div><saml2:Subject></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                            </span><saml2:NameID Format="<span style="background-color:rgb(255,255,0)">urn:oasis:names:tc:SAML:2.0:nameid-format:transient</span>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                             </span>              NameQualifier="<a href="https://idp.pima.edu/idp/shibboleth">https://idp.pima.edu/idp/shibboleth</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                             </span>              SPNameQualifier="<a href="https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7">https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                         </span>              ><span style="background-color:rgb(255,255,0)">_fedcaab0bd32f85998a32e26b7ed8e73</span></saml2:NameID></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                             </span><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                             </span><saml2:SubjectConfirmationData Address="144.90.132.76"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                            </span>                               InResponseTo="id191277203610250932120081916"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                           </span>                               NotOnOrAfter="2019-11-05T15:48:05.448Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                                </span>                               Recipient="<a href="https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                                                </span>                               /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                                            </span></saml2:SubjectConfirmation></div></div><div><br></div><div><br></div><div><br></div><div>Why does it only work when I use the attribute "user_id"?  I'm glad I was able to make it work but not happy that I don't understand why.    I will be happy to answer any questions for further clarification if needed.</div><div><br></div><div>Thanks for any feedback.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>IT Systems Architect (Acting)</div><div>Infrastructure Services - Applications<br></div><div>Pima Community College<br></div><div>520.206.4826<br></div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=1kpePdW3WkXNvx95EBuHo26kg1x50E5s4&revid=0B4QEFWYNTFJAcnoxVkhJaGtHaHBqdEI2SENTN0J1ODJmUkg0PQ" width="200" height="127"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>