<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>Abhishek,</div>
<div><br>
</div>
<div>See these docs on nameid, <a href="https://wiki.shibboleth.net/confluence/display/IDP4/NameIDGenerationConfiguration">https://wiki.shibboleth.net/confluence/display/IDP4/NameIDGenerationConfiguration</a></div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Fri, 2020-12-04 at 17:02 +0530, Abhishek Chouksey wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div style="font-size:8pt; color:#f58442 ; font-family: sans-serif; font-style:normal; font-weight:bold; padding:.2em">
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.
</div>
<br>
<div>
<div dir="ltr">Hi,<br>
I am new to shibboleth and trying to perform IDP initiated SSO<br>
<br>
My SP metadata file contain these attribute :<br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat><br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat><br>
<br>
=>does it means that my SP is accepting email address as nameIDFormat?<br>
<br>
and in my IDP attribute-resolver.xml :<br>
<br>
<!--Name Identifier related attributes --><br>
<resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId"><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/><br>
</resolver:AttributeDefinition><br>
<br>
so when request is made in saml tracer I can see that nameID is set to some encoded string<br>
Issuer = https://<xyz>/idp/shibboleth<br>
Subject = _8a6f5377a471fc24182dfa02ea194b43<br>
NameID = _8a6f5377a471fc24182dfa02ea194b43<br>
<br>
=>IS this due to Transient?<br>
<br>
=>So how can I make my nameID field to be set as my principal name like <a href="mailto:xyz@domain.com">
xyz@domain.com</a> because my SP is using nameID as username during access I guess?<br>
</div>
</div>
</blockquote>
<div><span>
<pre>-- <br></pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | <a href="mailto:rbon@uvic.ca">rbon@uvic.ca</a></div>
<div><br>
</div>
<div>I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations.</div>
</span></div>
</body>
</html>