<html><body><div dir="ltr">A new service is correctly consuming a more or less default SAML response from our IdP, with opaque transient nameID in the SAML Subject.<div dir="ltr">But they really want the scoped principal name (ePPN) of the user in the nameID, and I’ve failed so far to properly configure the IdP to do so.</div><div dir="ltr"><br></div><div dir="ltr">Their metadata as provided indicates:</div><div dir="ltr"><p style="margin:0px;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(71,91,98)"> <span style="color:#2176c7"><md:NameIDFormat></span>urn:oasis:names:tc:SAML:2.0:nameid-format:transient<span style="color:#2176c7"></md:NameIDFormat></span></p>
<p style="margin:0px;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(71,91,98)"> <span style="color:#2176c7"><md:NameIDFormat></span>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent<span style="color:#2176c7"></md:NameIDFormat></span></p>
<p style="margin:0px;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(71,91,98)"> <span style="color:#2176c7"><md:NameIDFormat></span>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress<span style="color:#2176c7"></md:NameIDFormat></span></p>
<p style="margin:0px;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(71,91,98)"> <span style="color:#2176c7"><md:NameIDFormat></span>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<span style="color:#2176c7"></md:NameIDFormat></span></p>
<p style="margin:0px;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(165,119,5)"><span style="color:#475b62"> </span><span style="color:#2176c7"><md:AssertionConsumerService </span><span style="color:#bd3613">Binding=</span>"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<span style="color:#2176c7"> </span><span style="color:#bd3613">Location=</span>"<a href="https://login.apogeenet.net/cas/login?client_name=SAML2Client0">https://login.apogeenet.net/cas/login?client_name=SAML2Client0</a>"<span style="color:#2176c7"> </span><span style="color:#bd3613">index=</span>"0"<span style="color:#2176c7">/></span></p></div><div dir="ltr">so I don’t suppose they really care about the format.</div><div dir="ltr"><br></div><div dir="ltr">When I attempt to provide ePPN via SAML-nameid.xml config, the SAML assertion has no nameID at all or has the default opaque transient nameID. </div><div dir="ltr">Tried many combinations but, as an example seeming parallel to a number of older integrations, with the </div><div dir="ltr"><ul style="margin:0px;list-style-type:"\002013 "" dir="ltr"><li>multiple NameIDFormat elements removed from metadata, and </li><li>saml-nameid.xml configured to use ePPN for nameID & emailAddress format for this service,<br></li><li>relying-party.xml configured for emailAddress precedence </li></ul></div><div dir="ltr">the subject contains unwanted long opaque transient nameID </div><div dir="ltr">If the format precedence is removed in relyin-party.xml the Subject contains no nameID at all.<br></div><div dir="ltr"><br></div><div dir="ltr">The only relevant message I see in logs at DEBUG is a repeat of what the metadata is requesting, and if “unspecified” is included, a warning that that is being ignored.</div><div dir="ltr"><br></div><div dir="ltr">What stupid interaction/config am I spacing on?</div><div dir="ltr"><br></div><div dir="ltr">David St Pierre Bantz</div></div></body></html>