<div dir="ltr"><div class="gmail_default" style="font-family:monospace,monospace">Thanks to everyone for their help and suggestions:</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">I've managed to produce the following:</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace"><saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"<br> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue><br> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"<br> NameQualifier="<a href="https://sso.mtholyoke.edu/idp/shibboleth">https://sso.mtholyoke.edu/idp/shibboleth</a>"<br> SPNameQualifier="<a href="https://admin.fifoundry.saml.">https://admin.fifoundry.saml.</a>../sp">w8L...</saml2:NameID><br> </saml2:AttributeValue><br> </saml2:Attribute></div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">Using the information on this page: <br></div><div class="gmail_default" style="font-family:monospace,monospace"></div><div class="gmail_default" style="font-family:monospace,monospace"><a href="https://spaces.at.internet2.edu/display/ShibInstallFest/InCommon+Shibboleth+IdP+Training+-+NameID+Configuration">https://spaces.at.internet2.edu/display/ShibInstallFest/InCommon+Shibboleth+IdP+Training+-+NameID+Configuration</a></div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">As well as the suggestions from James above.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">Thing is we still can't log into Everfi. The only troubling piece of information I have is from idp-process.log:</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">2020-01-09 16:54:49,199 - INFO [Shibboleth-Audit.SSO:275] - 20200109T215449Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|***|<a href="https://admin.fifoundry.net/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://sso.mtholyoke.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|***|cswoods|urn:oasis:names:tc:SAML:2.0:ac:classes:Password|eduPersonTargetedID,surname,givenName,email||***">https://admin.fifoundry.net/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://sso.mtholyoke.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|***|cswoods|urn:oasis:names:tc:SAML:2.0:ac:classes:Password|eduPersonTargetedID,surname,givenName,email||***</a></div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">If I understand the second from last field should show the value passed for NameID and that field is empty. I'm a bit confused as to how the SAML assertion could contain a NameID but somehow my own IDP thinks (or knows) that we are passing nothing to the SP.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">Thanks again for past and future help.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">-Chris<br></div><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-----------------------------------------------<br> Chris Woods, CISSP</div><div dir="ltr">He/him/his pronouns <br></div><div dir="ltr">Systems Administrator<br> Library, Information, and Technology Services<br> Mount Holyoke College<br> South Hadley, MA<br><br> 413-538-3536<br> <a href="mailto:cswoods@mtholyoke.edu" target="_blank">cswoods@mtholyoke.edu</a><br>----------------------------------------------- <br></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 8, 2020 at 11:26 AM Oulman,James F <<a href="mailto:oulman@ufl.edu" target="_blank">oulman@ufl.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
My notes from our integration with EverFi is that they want a persistent id in the format of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
We added a SAML2NameId Generator to saml-nameid.xml to send them EPPN</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
</span>
<div> p:omitQualifiers="true"<br>
</div>
<div> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"</div>
<div> p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }"><br>
</div>
<div> <property name="activationCondition"><br>
</div>
<div> <bean parent="shibboleth.Conditions.RelyingPartyId"<br>
</div>
<div> c:candidates="#{{</div>
<div> '<a href="https://fifoundry.net/saml/sp" target="_blank">https://fifoundry.net/saml/sp</a>'</div>
<div> }}"/><br>
</div>
<div> </property><br>
</div>
<span> </bean></span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span>And then configured the relying-party to force unspecified and disable encryption of NameIDs.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span><span> <bean parent="RelyingPartyByName"<br>
</span>
<div> c:relyingPartyIds="#{{<br>
</div>
<div> '<a href="https://fifoundry.net/saml/sp" target="_blank">https://fifoundry.net/saml/sp</a>'</div>
<div> }}" ><br>
</div>
<div> <property name="profileConfigurations"><br>
</div>
<div> <list><br>
</div>
<div> <bean parent="SAML2.SSO"<br>
</div>
<div> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<br>
</div>
<div> p:signResponses="true"<br>
</div>
<div> p:signAssertions="true"<br>
</div>
<div> p:encryptAssertions="true"<br>
</div>
<div> p:encryptNameIDs="false" /><br>
</div>
<div> <bean parent="SAML2.ECP"<br>
</div>
<div> p:signResponses="true"<br>
</div>
<div> p:signAssertions="true"<br>
</div>
<div> p:encryptAssertions="true"<br>
</div>
<div> p:encryptNameIDs="false" /><br>
</div>
<div> </list><br>
</div>
<div> </property><br>
</div>
<span> </bean></span><br>
</span></div>
<div>
<div id="gmail-m_8791218415549435044gmail-m_2229640989595442000appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
-James</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_8791218415549435044gmail-m_2229640989595442000divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of mhc-shib-admin <<a href="mailto:cswoods@mtholyoke.edu" target="_blank">cswoods@mtholyoke.edu</a>><br>
<b>Sent:</b> Wednesday, January 8, 2020 9:43 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a> <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> eduPersonTargetedID not being sent as persistent</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>[External Email]<br>
<br>
Hi Folks-<br>
<br>
I am setting up our IDP (v3.3) to work with Everfi. They are asking for a<br>
persistent nameID so I am sending them eduPersonTargetedID. On examining the<br>
SAML, I find this:<br>
<br>
<saml2:Subject><br>
<saml2:NameID<br>
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<br>
NameQualifier="<a></a><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__sso.mtholyoke.edu_idp_shibboleth&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=L7ZSO0pmrFS5YjcVKJ-lAV7uNO9bhwaXLvcLF7-znmM&e=" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__sso.mtholyoke.edu_idp_shibboleth&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=L7ZSO0pmrFS5YjcVKJ-lAV7uNO9bhwaXLvcLF7-znmM&e=</a>
"<br>
<br>
SPNameQualifier="<a></a><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__admin.fifoundry.net_mount-5Fholyoke-5Fcollege_saml_sp&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=gJbUKDlwQqznGSaKjRAUJe6Fpkpnz_VbzTW9lFFN-kc&e=" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__admin.fifoundry.net_mount-5Fholyoke-5Fcollege_saml_sp&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=gJbUKDlwQqznGSaKjRAUJe6Fpkpnz_VbzTW9lFFN-kc&e=</a>
">AAdzZWN....</saml2:NameID><br>
</saml2:Subject><br>
<br>
I didn't this was possible but as it, apparently is, can anyone suggest how<br>
I can change it to persistent?<br>
<br>
Thanks very much.<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.1660669.n2.nabble.com_Shibboleth-2DUsers-2Df1660767.html&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=arHFi2oZD-wi9y6RYRLHx9rImGhNlT1prglqq0t2RGE&e=" target="_blank">
https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.1660669.n2.nabble.com_Shibboleth-2DUsers-2Df1660767.html&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=arHFi2oZD-wi9y6RYRLHx9rImGhNlT1prglqq0t2RGE&e=</a><br>
--<br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=cDJS6M5Z1rWcRQMTYBJZvJMFSOB7BH8q-kG9xoS1oeA&e=" target="_blank">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=cDJS6M5Z1rWcRQMTYBJZvJMFSOB7BH8q-kG9xoS1oeA&e=</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div>
</span></font></div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>