No subject

[Rob Whitener]

Hello,

I have what I hope is a quick question regarding SP configuration and the
NameID format settings.  Our partner has indicated that they will be
sending a NameID with a format of transient.  Sounds good to us.  Recently,
they have come back and said that the metadata we have provided them
indicates that we don't support the transient NameID format.  They believe
that we need to configure our system to not include the following tags in
the metadata.

<md:ManageNameIDService Binding="*urn:oasis:names:tc:SAML:2.0:bindings:SOAP*
"Location="*https://www.dev.careverge.com/Shibboleth.sso/NIM/SOAP*" />
* * <md:ManageNameIDService Binding="*
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect*" Location="*
https://www.dev.careverge.com/Shibboleth.sso/NIM/Redirect*" />
* * <md:ManageNameIDService Binding="*
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST*" Location="*
https://www.dev.careverge.com/Shibboleth.sso/NIM/POST*" />
* * <md:ManageNameIDService Binding="*
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact*" Location="*
https://www.dev.careverge.com/Shibboleth.sso/NIM/Artifact*" />

I have looked through the documentation and I can't really find too much
documentation around configuring an SP to support transient NameID format.
 One thing I have seen is our REMOTE_USER attribute (on
ApplicationDefualts) contains 'eppn persistent-id target-id' as its value.
 We also have the following configured as part of our sessions:

<md:ManageNameIDService Location="/NIM/SOAP"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
            <md:ManageNameIDService Location="/NIM/Redirect"
conf:template="bindingTemplate.html"

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
            <md:ManageNameIDService Location="/NIM/POST"
conf:template="bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
            <md:ManageNameIDService Location="/NIM/Artifact"
conf:template="bindingTemplate.html"

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>

Is Shibboleth SP configured to use persistent nameId's out of the box by
default, and if so do any of these configuration element govern that
behavior?

Thank you,

Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120717/c3dd6303/attachment.html