Hot do I get users ID in an OpenSAML (SP) + OpenAM (IdP) environment

[Brent Putman]

On 11/14/12 1:34 PM, Stephen Gaines wrote:
>
> My problem is that the only type of ID I see coming from OpenAM is
> what appears to be an encrypted ID.
>

Coming from what source in the Assertion: the NameID or an Attribute?

And do you literally mean 'encrypted', which has a very specific meaning
in cryptography? (as opposed to just encoded, or some sort of opaque
value)  If the SP encrypted it with a key that you hold and that you
gave to them, then you decrypt it, pure and simple.  OpenSAML has
support for that, but you first need to verify what they are sending you.


> Is there some way to have OpenSAML parse this ID?
>

Well, yes, but it isn't clear what it is yet...


> I need to know who is logged in and this randomly encrypted ID doesn't
> provide me direct access to that information.
>


The phrase "randomly encrypted" makes me think it's perhaps not
encrypted and it is merely some kind of randomly generated, opaque
value.  This is common for a NameID types like persistent and transient
ID's.  Those are typically not reversible.  They are intended to be used
as-is as a user identifier, and they consciously don't expose the user's
identity.

If they send such a NameID, it's possible that they are also sending
something like a "username" or "principal name" in an Attribute value.
Did you check there?

It's entirely possible that the IdP isn't sending you anything like a
username, esp. if you didn't configure it do to do that.  It's certainly
not a requirement or default expectation of SAML.

--Brent



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121114/31fd52d9/attachment.html