How do I send Subject->NameID in "clear" text

[Jason Holland]

I'm inching along on the setup and configuration of my Shibboleth IdP
and I appreciate all the help everyone! Again, I am trying to get my
Shib IdP to support a new Name Identifier
(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier)
and I'm having challenges.

I went back and scoured the documentation and followed it to the best of
my ability and I think I created a bug or found a bug or screwed
something up even more. For the NameID (which I have "9185551212"
hard-coded in a static attribute) I'm getting something like this
"org.opensaml.saml2.core.impl.NameIDImpl at 9403a3" where the alphanumeric
code after the @ sign changes at each login test I do.

The idp-process.log does confirm that the NameID will be built from my
attribute:
...AbstractSAMLProfileHandler:483] - Name identifier for relying party
'http://sp1.example.loc/simplesaml/module.php/saml/sp/metadata.php/sp1'
will be built from attribute 'commPortalPhone'

I have included the related idp-process.log messages that deal with my
attribute and my new configs below. Any help is greatly appreciated!

******************************* BEGIN ********************************
$IDPHOME/conf/relying-party.xml
======================================================================
<rp:RelyingParty
 
id="http://sp1.example.loc/simplesaml/module.php/saml/sp/metadata.php/sp
1"
  provider="https://idp.example.org/idp/shibboleth"
  defaultSigningCredentialRef="IdPCredential"
 
nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspec
ified">
    <rp:ProfileConfiguration
      xsi:type="saml:SAML2SSOProfile"
      encryptAssertions="never"
      encryptNameIds="never" />
</rp:RelyingParty>


$IDPHOME/conf/attribute-resolver.xml
======================================================================
<resolver:AttributeDefinition
  xsi:type="SAML2NameID"
  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
  id="commPortalPhone"
  sourceAttributeID="commPortalPhone">
     <resolver:Dependency ref="staticAttributes" />
     <resolver:AttributeEncoder
       xsi:type="enc:SAML2StringNameID"
 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>

<resolver:DataConnector
  id="staticAttributes"
  xsi:type="Static"
  xmlns="urn:mace:shibboleth:2.0:resolver:dc">
     <Attribute id="commPortalPhone">
        <Value>9185551212</Value>
    </Attribute>
</resolver:DataConnector>


$IDPHOME/conf/attribute-filter.xml
======================================================================
<afp:AttributeFilterPolicy id="releaseCommPortalPhoneToAnyone">
    <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
    <afp:AttributeRule attributeID="commPortalPhone">
        <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>


$IDPHOME/logs/idp-process.log
======================================================================
...AttributeResolver:314] - Resolving attribute commPortalPhone for
principal jholland at olp.net
...AttributeResolver:336] - Resolved attribute commPortalPhone
containing 1 values
...AttributeResolver:468] - Attribute commPortalPhone has 1 values after
post-processing
...AttributeResolver:137] - shibboleth.AttributeResolver resolved, for
principal jholland at olp.net, the attributes: [commPortalPhone]
...AttributeFilteringEngine:130] - Evaluating if filter policy
releaseCommPortalPhoneToAnyone is active for principal jholland at olp.net
...AttributeFilteringEngine:139] - Filter policy
releaseCommPortalPhoneToAnyone is active for principal jholland at olp.net
...AttributeFilteringEngine:163] - Processing permit value rule for
attribute commPortalPhone for principal jholland at olp.net
...AttributeFilteringEngine:109] - Attribute commPortalPhone has 1
values after filtering
...AttributeFilteringEngine:114] - Filtered attributes for principal
jholland at olp.net.  The following attributes remain: [commPortalPhone]
...AttributeAuthority:226] - Attribute commPortalPhone was not encoded
because no SAML2AttributeEncoder was attached to it.
...AbstractSAMLProfileHandler:523] - Retaining attribute commPortalPhone
which may be encoded to via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameI
DEncoder
...AbstractSAMLProfileHandler:483] - Name identifier for relying party
'http://sp1.example.loc/simplesaml/module.php/saml/sp/metadata.php/sp1'
will be built from attribute 'commPortalPhone'
...AbstractSAML2ProfileHandler:850] - Using attribute 'commPortalPhone'
supporting NameID format
'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' to create the
NameID for relying party
'http://sp1.example.loc/simplesaml/module.php/saml/sp/metadata.php/sp1'
12:03:17.664 - DEBUG [PROTOCOL_MESSAGE:74] -
<saml2p:Response ...>
...
<saml2:Subject>
   <saml2:NameID
     Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
     NameQualifier="https://idp.example.org/idp/shibboleth"
 
SPNameQualifier="http://sp1.example.loc/simplesaml/module.php/saml/sp/me
tadata.php/sp1"
     >org.opensaml.saml2.core.impl.NameIDImpl at 9403a3</saml2:NameID>
   ...
</saml2:Subject>
...
</saml2p:Response>
********************************* END ********************************

Thanks,
Jason

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
On Behalf Of Cantor, Scott
Sent: Tuesday, December 27, 2011 2:17 PM
To: users at shibboleth.net
Subject: Re: How do I send Subject->NameID in "clear" text

On 12/27/11 3:05 PM, "Jason Holland" <jholland at olp.net> wrote:

>My ProfileConfiguration has encryptNameIds set to "never" so maybe I'm 
>making an amateur mistake with my configuration. To make it as simple 
>as possible I hard-coded a phone number in a static attribute and it is

>still not being put in clear text in the response.

It's not there at all. The attribute being chosen for inclusion is the
transient identifier, that's not your phone number.

You cannot use the transient Format for your own purposes. You have to
define a custom Format, and you have to ensure that that's the value
used either via metadata (NameIDFormat), precedence rules in
relying-party.xml, or attribute filtering.

-- Scott

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net