<html><body><div dir="ltr">
Yes I’ve run these 3 variations:</div><div dir="ltr"><ul style="margin:0px;list-style-type:"\002013 ""><li>all 4 policies<br></li><li>no policies<br></li><li>only the emalAddress policy<br><br></li></ul></div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 06Oct2022 at 15:58:52, "Mak, Steven" <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div>
<div>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
</div>
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">For an easy test, remove the other NameIDPolicies in the SP metadata so only emailAddress is remaining.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Then just make sure the logic of your resolver config allows the release of some attribute that can fulfill that policy to that service.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Steve</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>><br>
<b>Date: </b>Thursday, October 6, 2022 at 7:55 PM<br>
<b>To: </b>Mak, Steven <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>><br>
<b>Cc: </b>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject: </b>Re: getting desired value into nameID</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">I’m debugging the config against the resolver exerciser and unsolicited request, so no normal incoming SAML request.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">David</span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">On 06Oct2022 at 15:42:58, "Mak, Steven" <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:</span></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">Double check the SAML request that is coming in. If it is stating something like NameIDPolicy > unspecified + Exact, then that may be why you are
having trouble.</span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">- Steve Mak</span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div></body></html>