<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">You have to release the attribute (mail) that you want to base the NameID on.<div><br></div><div>p.s. You actually almost never need activation conditions in saml-nameid.xml, that will just cause you more work in the future if you have to similarly send some other service that emailAddress NameID format. And you probably don't need a relying party override either, because you could just be sure you have a NameIDFormat element in the local metadata you have for the service that specifies that format. Lots of people cause themselves extra work by thinking they need relying party overrides and activation conditions to manage NameIDs, when most of the time neither are needed.<br><div><br><blockquote type="cite"><div>On Mar 22, 2024, at 9:49 AM, Alberto DeAngelis via users <users@shibboleth.net> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr">Hi Everyone,<div><br></div><div>I am running into this issue setting up SSO for Ellucian Experience:</div><div><br></div><div>shib-idp;idp-warn.log;dev;nothing;2024-03-22 13:54:34,540 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy<br>shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2024-03-22 13:56:16,226 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidNameIDPolicy<br><div><br></div><div>This is what we have for our relying party configuration:</div><div><br><bean parent="RelyingPartyByName" c:relyingPartyIds="ellucian-experience"><br> <property name="profileConfigurations"> <br> <list><br> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br> </list><br> </property><br> </bean><br><br>This is our saml-nameid.xml configuration:</div><div><br> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br> p:attributeSourceIds="#{ {'mail'} }" ><br> <property name="activationCondition" ><br> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="ellucian-experience" /><br> </property><br> </bean><br><br>This is our attribute-filter.xml configuration:</div><div><br><AttributeFilterPolicy id="releaseForEllucianExp" ><br> <PolicyRequirementRule xsi:type="Requester" value="ellucian-experience" /><br> <AttributeRule attributeID="employeeNumber"><br> <PermitValueRule xsi:type="ANY" /><br> </AttributeRule><br></AttributeFilterPolicy><br></div><div><br></div><div>I am not sure what else to check.</div><div><br></div><div>I appreciate your help with this.</div><div><br></div><div>Alberto</div><div><br></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-size:small"><span style="font-weight:bolder;color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><span style="color:rgb(4,106,56)">Alberto DeAngelis</span></span><span style="color:rgb(4,106,56);font-family:Georgia,sans-serif;font-size:14px;font-weight:700"> '20 '22</span><br style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><span style="color:rgb(4,106,56);font-family:Georgia,sans-serif;font-size:14px"><i>JrDatabaseAdmin/IT Dept.<br>Information Technology Services</i></span><span style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"></span><br style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><img src="https://content.manhattan.edu/nav-files/mc-logo_green.png" alt="Manhattan College Logo/Shield" style="vertical-align:middle;border-style:none;color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px;width:170px;height:54px"><span style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"></span><br style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><span style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px">Riverdale, NY 10471</span><br style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><a href="mailto:adeangelis01@manhattan.edu" style="color:rgb(50,98,149);background-color:transparent;line-height:inherit;font-family:Georgia,sans-serif;font-size:14px" target="_blank">adeangelis01@manhattan.edu</a><span style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"></span><br style="color:rgb(57,57,57);font-family:Georgia,sans-serif;font-size:14px"><a href="http://www.manhattan.edu/" style="color:rgb(50,98,149);background-color:transparent;line-height:inherit;font-family:Georgia,sans-serif;font-size:14px" target="_blank">www.manhattan.edu</a><br></div></div></div></div></div></div></div></div></div>
-- <br>For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></blockquote></div><br><div>
<div>--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></div></body></html>