a simple recipe for copying attribute into Subject/NameID

[Jason Winshell]

Hi,

I'm using Shibboleth for the simple purpose of testing service provider code. I need the "for dummies" recipe for doing something which is supposedly simple according to the documentation.

I am releasing an attribute called 'uid' from LDAP into an authorization response. It works perfectly. However, the response <Subject>/<NameID> content contains a long transient value. I need a recipe, cut copy paste recipe for taking the same uid attribute and putting its value in the NameID. 

I am using OIOSAML as my service provider. I need my NameID policy to X509Subject to work for my specific purpose. So far I've had to set it to transient to get Shibboleth to not produce an error about an unsupported NameID policy.

I've already read:

http://shibboleth.1660669.n2.nabble.com/SAML-Subject-NameID-td6512328.html

and

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier


I've spent way too many hours trying to accomplish this simple task uid=>NameID problem. I'd like it both as an attribute and in NameID. I could really use some practical help. 

Thanks in advance for your answers.

Jason

In attribute-resolver.xml:

     <resolver:AttributeDefinition xsi:type="ad:Simple"
        id="uid" sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid" friendlyName="uid" />
        <!-- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /> -->
    </resolver:AttributeDefinition>

<!-- BTW, I have no idea why I need transientId. But I found that without it there was nothing in the Subject/Name -->

    <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://localhost:389" 
        baseDN="dc=localhost" 
        principal=""
        principalCredential="">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>

In attribute-filter.xml:

   <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

       <afp:AttributeRule attributeID="uid">
          <afp:PermitValueRule xsi:type="basic:ANY" />
    <  /afp:AttributeRule>

    </afp:AttributeFilterPolicy>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130628/9ce20a20/attachment.html