<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:818227546;
mso-list-template-ids:655665666;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">So, why can’t you just put the eppn in the name ID with an email address format? Since that’s an allowed format and they want the eppn as the value, just add eppn to the list of attributes allowed to populate the attribute sourced name
ID that has a format of emailAddress and release eppn to the service. Or am I missing something here?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>IAM David Bantz via users<br>
<b>Sent:</b> Thursday, October 6, 2022 6:29 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> IAM David Bantz <dabantz@alaska.edu><br>
<b>Subject:</b> getting desired value into nameID<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">A new service is correctly consuming a more or less default SAML response from our IdP, with opaque transient nameID in the SAML Subject.<o:p></o:p></p>
<div>
<p class="MsoNormal">But they really want the scoped principal name (ePPN) of the user in the nameID, and I’ve failed so far to properly configure the IdP to do so.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Their metadata as provided indicates:<o:p></o:p></p>
</div>
<div>
<p style="margin:0in;font-stretch:normal"><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62"> </span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"><md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">urn:oasis:names:tc:SAML:2.0:nameid-format:transient</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"></md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62"><o:p></o:p></span></p>
<p style="margin:0in;font-stretch:normal"><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"><md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"></md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62"><o:p></o:p></span></p>
<p style="margin:0in;font-stretch:normal"><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"><md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"></md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62"><o:p></o:p></span></p>
<p style="margin:0in;font-stretch:normal"><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"><md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"></md:NameIDFormat></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62"><o:p></o:p></span></p>
<p style="margin:0in;font-stretch:normal"><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#475B62">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7"><md:AssertionConsumerService
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#BD3613">Binding=</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#A57705">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#BD3613">Location=</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#A57705">"<a href="https://urldefense.com/v3/__https:/login.apogeenet.net/cas/login?client_name=SAML2Client0__;!!DZ3fjg!9iKEQYEAi-xWjGuXd1ffHy2zsxceUatg7rg42P79iA59qVLkH5gyf6Xw3MEfm0Ef2mygYpTUa5GGRapMwpdY$">https://login.apogeenet.net/cas/login?client_name=SAML2Client0</a>"</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7">
</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#BD3613">index=</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#A57705">"0"</span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#2176C7">/></span><span style="font-size:7.5pt;font-family:"Menlo",serif;color:#A57705"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">so I don’t suppose they really care about the format.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When I attempt to provide ePPN via SAML-nameid.xml config, the SAML assertion has no nameID at all or has the default opaque transient nameID. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Tried many combinations but, as an example seeming parallel to a number of older integrations, with the <o:p></o:p></p>
</div>
<div>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
multiple NameIDFormat elements removed from metadata, and <o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
saml-nameid.xml configured to use ePPN for nameID & emailAddress format for this service,<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
relying-party.xml configured for emailAddress precedence <o:p></o:p></li></ul>
</div>
<div>
<p class="MsoNormal">the subject contains unwanted long opaque transient nameID <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If the format precedence is removed in relyin-party.xml the Subject contains no nameID at all.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The only relevant message I see in logs at DEBUG is a repeat of what the metadata is requesting, and if “unspecified” is included, a warning that that is being ignored.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What stupid interaction/config am I spacing on?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">David St Pierre Bantz<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>