<div dir="ltr">Thank you for you feedback.<br>I commented this line at <span style="color:rgb(80,0,80)">saml-nameid.properties:</span><br><span style="color:rgb(80,0,80)">#idp.nameid.saml2.default =</span><span style="color:rgb(80,0,80)">urn:oasis:names:tc:SAML:1.1:na</span><span style="color:rgb(80,0,80)">meid-format:emailAddress<br></span><br>I added this configuration on <b><font color="#ff0000">saml-nameid.xml</font></b>:<br><br><font face="garamond, times new roman, serif"><i><bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br> p:omitQualifiers="true"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br> p:attributeSourceIds="#{ {'mail'} }" /> </i></font><div><br></div><div>And this configuration on <b style="background-color:rgb(255,255,255)"><font color="#ff0000">attribute-resolver.xml</font></b>:<br><br> <font face="garamond, times new roman, serif"><i><AttributeDefinition id="mail" xsi:type="PrincipalName"><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" friendlyName="mail" /><br> </AttributeDefinition></i></font><br></div><div><font face="garamond, times new roman, serif"><i><br></i></font></div><div>And this configuration on <b><font color="#ff0000">relying-party.xml</font></b></div><div><br></div><div><i><font face="garamond, times new roman, serif"><util:list id="shibboleth.RelyingPartyOverrides"><br> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId">https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId</a>"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:encryptAssertions="false" /><br> </list><br> </property><br> </bean><br> </util:list></font></i><br></div><div><font face="garamond, times new roman, serif"><i><br></i></font></div><div><font face="arial, sans-serif" style="">But I got this error on </font><b>idp-process.log:</b></div><div>INFO [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227] - Attribute sources [mail] did not produce a usable identifier<br>WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br><br><b>I don't know how to get attributeSourceIds?</b><br>I have this data on the <b>idp-process.log</b>:<br><br>WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:93] - Relay state exceeds 80 bytes: {"loginEmail":"<a href="mailto:test_sso@example.com">test_sso@example.com</a>","loginType":"CONFIRMATION","redirect":"<a href="https://app.hubspot.com/settings-sso-confirm">https://app.hubspot.com/settings-sso-confirm</a>","rememberLogin":false}<br>INFO [Shibboleth-Audit.SSO:275] - 20210604T211422Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|ONELOGIN_40077r94-1755-45be-b4fc-0616948d6555|<a href="https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myhostname.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_261cae8e5a0c0b2341d79f3fea31e399|test_sso@example.com">https://api.hubspot.com/login-api/v1/saml/login?portalId=myPortalId|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myhostname.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_261cae8e5a0c0b2341d79f3fea31e399|test_sso@example.com</a><br><br>Thank you in advance</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Am Fr., 4. Juni 2021 um 17:00 Uhr schrieb Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> [2021-06-04 17:48]:<br>
> That means your IDP is not configured to produce NameIDs of that format.<br>
<br>
This.<br>
<br>
> > Note that I didn't change saml-nameid.xml but I<br>
> > changed saml-nameid.properties:<br>
> > idp.nameid.saml2.default =<br>
> > urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<br>
> <br>
> A *very* bad idea (setting that as default), but also quite obviously<br>
> it didn't take, otherwise the IDP wouldn't be throwing that error?<br>
<br>
I missed that changing the default is no replacement for telling the<br>
IDP what to put into the NameID. I.e., you'd still need to configure<br>
saml-nameid.xml appropriately.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:12.8px">Software Engineer</span></div><div>Oracle Certified Professional Java SE 6 Programmer</div><div>Tel: 0674-931593</div><div><br></div></div></div></div></div>