<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 11/14/12 1:34 PM, Stephen Gaines
wrote:<br>
</div>
<blockquote
cite="mid:7C48978F1A5EBE47A6B89E9A2EBE7F4EBC426D9E@APPT-EXCHANGE3.apptcentral.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">My problem is that the only type of ID I
see coming from OpenAM is what appears to be an encrypted ID.
</p>
</div>
</blockquote>
<br>
Coming from what source in the Assertion: the NameID or an
Attribute?<br>
<br>
And do you literally mean 'encrypted', which has a very specific
meaning in cryptography? (as opposed to just encoded, or some sort
of opaque value) If the SP encrypted it with a key that you hold
and that you gave to them, then you decrypt it, pure and simple.
OpenSAML has support for that, but you first need to verify what
they are sending you.<br>
<br>
<br>
<blockquote
cite="mid:7C48978F1A5EBE47A6B89E9A2EBE7F4EBC426D9E@APPT-EXCHANGE3.apptcentral.local"
type="cite">
<div class="WordSection1">
<p class="MsoNormal">Is there some way to have OpenSAML parse
this ID?</p>
</div>
</blockquote>
<br>
Well, yes, but it isn't clear what it is yet...<br>
<br>
<br>
<blockquote
cite="mid:7C48978F1A5EBE47A6B89E9A2EBE7F4EBC426D9E@APPT-EXCHANGE3.apptcentral.local"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"> I need to know who is logged in and this
randomly encrypted ID doesn’t provide me direct access to that
information.</p>
</div>
</blockquote>
<br>
<br>
The phrase "randomly encrypted" makes me think it's perhaps not
encrypted and it is merely some kind of randomly generated, opaque
value. This is common for a NameID types like persistent and
transient ID's. Those are typically not reversible. They are
intended to be used as-is as a user identifier, and they consciously
don't expose the user's identity.<br>
<br>
If they send such a NameID, it's possible that they are also sending
something like a "username" or "principal name" in an Attribute
value. Did you check there?<br>
<br>
It's entirely possible that the IdP isn't sending you anything like
a username, esp. if you didn't configure it do to do that. It's
certainly not a requirement or default expectation of SAML.<br>
<br>
--Brent<br>
<br>
<br>
<br>
</body>
</html>