Hot do I get users ID in an OpenSAML (SP) + OpenAM (IdP) environment

[Stephen Gaines]

Guess from what you're saying I need to figure out how to configure OpenAM to send the user id as an attribute and ignore the NameID. Currently it's not sending any attributes with the Assertion. Here's the subject, it says the NameID is transient.

<saml:Subject>
                <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="http://localhost:7080/openam" SPNameQualifier="http://localhost:8080">cGMR3nDv+7sH/9P2NHP6OTVH7YJx</saml:NameID>
                <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                                <saml:SubjectConfirmationData NotOnOrAfter="2012-11-14T15:43:48Z" Recipient="http://localhost:8080/saml"/>
                </saml:SubjectConfirmation>
</saml:Subject>

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Wednesday, November 14, 2012 1:30 PM
To: dev at shibboleth.net
Subject: Re: Hot do I get users ID in an OpenSAML (SP) + OpenAM (IdP) environment


On 11/14/12 1:34 PM, Stephen Gaines wrote:
My problem is that the only type of ID I see coming from OpenAM is what appears to be an encrypted ID.

Coming from what source in the Assertion: the NameID or an Attribute?

And do you literally mean 'encrypted', which has a very specific meaning in cryptography? (as opposed to just encoded, or some sort of opaque value)  If the SP encrypted it with a key that you hold and that you gave to them, then you decrypt it, pure and simple.  OpenSAML has support for that, but you first need to verify what they are sending you.



Is there some way to have OpenSAML parse this ID?

Well, yes, but it isn't clear what it is yet...



I need to know who is logged in and this randomly encrypted ID doesn't provide me direct access to that information.


The phrase "randomly encrypted" makes me think it's perhaps not encrypted and it is merely some kind of randomly generated, opaque value.  This is common for a NameID types like persistent and transient ID's.  Those are typically not reversible.  They are intended to be used as-is as a user identifier, and they consciously don't expose the user's identity.

If they send such a NameID, it's possible that they are also sending something like a "username" or "principal name" in an Attribute value. Did you check there?

It's entirely possible that the IdP isn't sending you anything like a username, esp. if you didn't configure it do to do that.  It's certainly not a requirement or default expectation of SAML.

--Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121114/84b62e07/attachment.html