configuring idp to release the "remote_user" as nameid

[David Mansfield]

On 06/25/2013 11:13 AM, Peter Schober wrote:
> * David Mansfield <shibboleth at dm.cobite.com> [2013-06-25 17:08]:
>> Well, you definitely make a very good case for changing my ways ;-).  My
>> only other experience with SAML is running a Shibboleth SP where the
>> partner is sending the kerberos principal as a
>> urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, so I thought this
>> was standard practice.
>
> That's different because "unspecified" doesn't make any promises about
> the NameID format, and so by defintion a kerberos principal name
> fulfills the requirements for an "unspecified" NameID (as would any
> other string, random or not).
>
> In your case you're making claims about an identifier by labelling it
> "persistent", when it fact it's not, according to the defintion of a
> persistent NameID.
>
>> I'll look into a computedId solution, and send the kerberos
>> principal as a regular attribute.  On the SP side I can map this
>> using the attribute map however I want anyway.
>
> You could also just ignore the custom NameID, stick with default
> (transient) and just go with attributes.
> Will work just as well as /generating/ "persistent" (see the
> contradiction in terms?) identifiers from changable values (i.e., he
> kerberos principal name), without the configuration overhead.

That sounds solid.  I picked "persistent" because the only types I saw 
in the wiki as supported were transient or persistent, and I saw that 
transient was a pseudo-random hex string, and figured the alternative 
must be persistent.  That was a naive understanding of how this works, 
and I get what you are saying completely, and will definitely re-work this.

By the way, this worked just in case anyone else is "hell-bent on 
violating the SAML spec":

<resolver:AttributeDefinition
  xsi:type="PrincipalName"
  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
  id="persistentId">

   <resolver:AttributeEncoder
    xsi:type="enc:SAML2StringNameID"
    nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>

</resolver:AttributeDefinition>

Thanks for all your help,
David