<div dir="ltr"><div>Hi Peter (et al),</div><div><br></div><div>FYI, for the NameID, I did as you suggested in your earlier post:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:<br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
here's what you'd add:<br>
<br>
<bean parent="shibboleth.SAML2AttributeSourcedGenerator" <br>
p:omitQualifiers="true" <br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" <br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
Provided that the IDP has an internal attribute called 'mail' which<br>
holds the subject's email address from whatever data source.<br>
If your LDAP server has the subject's email adresss in the LDAP<br>
attribute "cn" (which I would find highly unusual) then you could<br>
either rename the attribute with your IDP attribute resolver by adding<br>
this to the end of your LDAP DataConnector:<br>
<Column columnName="cn" attributeID="mail" /><br>
of you'd change the above example for the NameID generation to use<br>
'cn' where it currently says 'mail'.
<br></blockquote><div><br></div><div><br></div><div>Actually, there was already the section that you described above in the file, but it was commented out.</div><div><br></div><div>So, all I had to do was UNcomment that section, and changed the "mail" to "cn" (exactly as you said) and now, I am seeing the NameID in the SAMLResponse!!</div><div><br></div><div>Also FYI, I tested with the other IdP "in front" and I am now getting successful authentication all the way "back" to the "in front" SP/IdP!!</div><div><br></div><div>AMAZING :(!!</div><div><br></div><div>Thanks again, to everyone, for all of your help, and (again), patience!!</div><div><br></div><div>Jim</div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Apr 11, 2025 at 8:18 AM Peter Schober via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">o haya via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> [2025-04-11 02:29 CEST]:<br>
> After some discussion, we want the NameID format to be emailAddress, and<br>
> for the source to be the "cn" attribute. Also "cn" values will be<br>
> emailAddress format.<br>
<br>
In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:<br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
here's what you'd add:<br>
<br>
<bean parent="shibboleth.SAML2AttributeSourcedGenerator" <br>
p:omitQualifiers="true" <br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" <br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
Provided that the IDP has an internal attribute called 'mail' which<br>
holds the subject's email address from whatever data source.<br>
If your LDAP server has the subject's email adresss in the LDAP<br>
attribute "cn" (which I would find highly unusual) then you could<br>
either rename the attribute with your IDP attribute resolver by adding<br>
this to the end of your LDAP DataConnector:<br>
<Column columnName="cn" attributeID="mail" /><br>
of you'd change the above example for the NameID generation to use<br>
'cn' where it currently says 'mail'.<br>
<br>
So first get the data into the IDP, then put it into a NameID.<br>
The final piece is making sure the NameID with the desired Format is<br>
sent to the SP in question. The correct and easiest way to do this is<br>
my amending the SP Metadata (that the IDP has on record) with the<br>
desired NameID Format:<br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat><br>
<br>
HTH,<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>