<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Mathis,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Typically I use the file saml-nameid.xml to set the persistent id generator to use the specified format.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
you then only need to release the actual attribute to the sp. So in this cause you would have a clause in attribute-filter.xml that releases eMailAddress.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Then in the saml-nameid.xml you could have 2 entries for the sp.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
you wil lneed an entry that will tell the generator not to use the default method.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
then an entry that says for entityid blah use method xyz.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
should be examples in that file.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px"><font size="2"><font face="Courier New">--<br>
Aterea Brown, AUT University<br>
Cybersecurity, ICT<br>
Email: atbrown@aut.ac.nz Phone: 9219999 x 6523</font></font></div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Mathis, Bradley <bmathis@pima.edu><br>
<b>Sent:</b> Thursday, 14 November 2019 8:05 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> White, Jeff <jwhite@pima.edu><br>
<b>Subject:</b> Subject NameID format question</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div><br>
</div>
<div>I have set setup SSO for couple of applications where the SP requires Subject NameID format to be Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</div>
<div><br>
</div>
<div>I'm able to do this successfully only if I release a specific attribute that's defined in my attribute-resolver.xml as "user_id" e.g.</div>
<div><br>
</div>
<div>
<div> <resolver:AttributeDefinition xsi:type="ad:Template" id="user_id"></div>
<div> <resolver:Dependency ref="myLDAP" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div>
<div> <ad:SourceAttribute>mail</ad:SourceAttribute></div>
<div></resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>The part I don't understand is this I have at least 2 other attributes definitions in the attribute-resolver.xml that do not work if I release them instead, such as the attribute "frshid"</div>
<div><br>
</div>
<div>
<div><resolver:AttributeDefinition xsi:type="ad:Template" id="frshid"></div>
<div> <resolver:Dependency ref="myLDAP" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></div>
<div> <ad:SourceAttribute>mail</ad:SourceAttribute></div>
<div></resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Here a snippet of the Subject from a SAML trace when it works releasing the attribute "user_id"</div>
<div><br>
</div>
<div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:Subject></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:NameID Format="<span style="background-color:rgb(255,255,0)">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</span>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> NameQualifier="<a href="https://idp.pima.edu/idp/shibboleth">https://idp.pima.edu/idp/shibboleth</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> SPNameQualifier="<a href="https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7">https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> ><span style="background-color:rgb(255,255,0)"><a href="mailto:trename01@pima.edu">trename01@pima.edu</a></span></saml2:NameID></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:SubjectConfirmationData Address="144.90.132.76"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> InResponseTo="id191289947414822031926171130"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> NotOnOrAfter="2019-11-05T16:09:32.123Z"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> Recipient="<a href="https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> /></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span></saml2:SubjectConfirmation></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Here's a snippet of the Subject from a SAML trace when it doesn't work releasing the attribute "frshid".</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div><saml2:Subject></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:NameID Format="<span style="background-color:rgb(255,255,0)">urn:oasis:names:tc:SAML:2.0:nameid-format:transient</span>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> NameQualifier="<a href="https://idp.pima.edu/idp/shibboleth">https://idp.pima.edu/idp/shibboleth</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> SPNameQualifier="<a href="https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7">https://www.okta.com/saml2/service-provider/spin7qorz7IoNah7c0x7</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> ><span style="background-color:rgb(255,255,0)">_fedcaab0bd32f85998a32e26b7ed8e73</span></saml2:NameID></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span><saml2:SubjectConfirmationData Address="144.90.132.76"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> InResponseTo="id191277203610250932120081916"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> NotOnOrAfter="2019-11-05T15:48:05.448Z"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> Recipient="<a href="https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest">https://adbe-4bf37e265d9f449a0a495ce8-cdcd-prd.okta.com/auth/saml20/accauthlinktest</a>"</div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span> /></div>
<div><span class="x_gmail-Apple-tab-span" style="white-space:pre"></span></saml2:SubjectConfirmation></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Why does it only work when I use the attribute "user_id"? I'm glad I was able to make it work but not happy that I don't understand why. I will be happy to answer any questions for further clarification if needed.</div>
<div><br>
</div>
<div>Thanks for any feedback.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<br clear="all">
<div>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>
<div></div>
<div><br>
</div>
<div>Brad Mathis</div>
<div>IT Systems Architect (Acting)</div>
<div>Infrastructure Services - Applications<br>
</div>
<div>Pima Community College<br>
</div>
<div>520.206.4826<br>
</div>
<div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div>
</div>
<div><br>
</div>
<div><img width="200" height="127" src="https://docs.google.com/uc?export=download&id=1kpePdW3WkXNvx95EBuHo26kg1x50E5s4&revid=0B4QEFWYNTFJAcnoxVkhJaGtHaHBqdEI2SENTN0J1ODJmUkg0PQ"><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>