Re: a simple recipe for copying attribute into Subject/NameID

[Kevin P. Foote]

Jason,

Sorry no cut and paste.. I'm on my phone. But here is what you need to do...

In your relying-party.xml you need to tell it what properly encoded attribute to use for the NameId for this particular SP. So make a specific entry for that SP.

You also need to configure a release in your attribute-filter.xml for your particular SP that denies release of your other NameID encoded attributes.

HTH

sent from mobile

----- Reply message -----
From: "Jason Winshell" <jason at jasonwinshell.com>
To: <users at shibboleth.net>
Subject: a simple recipe for copying attribute into Subject/NameID
Date: Fri, Jun 28, 2013 8:45 PM
Hi,
I'm using Shibboleth for the simple purpose of testing service provider code. I need the "for dummies" recipe for doing something which is supposedly simple according to the documentation.
I am releasing an attribute called 'uid' from LDAP into an authorization response. It works perfectly. However, the response <Subject>/<NameID> content contains a long transient value. I need a recipe, cut copy paste recipe for taking the same uid attribute and putting its value in the NameID. 
I am using OIOSAML as my service provider. I need my NameID policy to X509Subject to work for my specific purpose. So far I've had to set it to transient to get Shibboleth to not produce an error about an unsupported NameID policy.
I've already read:
http://shibboleth.1660669.n2.nabble.com/SAML-Subject-NameID-td6512328.html
and
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

I've spent way too many hours trying to accomplish this simple task uid=>NameID problem. I'd like it both as an attribute and in NameID. I could really use some practical help. 
Thanks in advance for your answers.
Jason
In attribute-resolver.xml:
<resolver:AttributeDefinition xsi:type="ad:Simple"        id="uid" sourceAttributeID="uid">        <resolver:Dependency ref="myLDAP" />        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid" friendlyName="uid" />        <!-- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /> -->    </resolver:AttributeDefinition>
<!-- BTW, I have no idea why I need transientId. But I found that without it there was nothing in the Subject/Name -->
<resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>    </resolver:AttributeDefinition>
<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"        ldapURL="ldap://localhost:389"         baseDN="dc=localhost"         principal=""        principalCredential="">        <dc:FilterTemplate>            <![CDATA[                (uid=$requestContext.principalName)            ]]>        </dc:FilterTemplate>    </resolver:DataConnector>
In attribute-filter.xml:
<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
<afp:AttributeRule attributeID="transientId">            <afp:PermitValueRule xsi:type="basic:ANY"/>        </afp:AttributeRule>
<afp:AttributeRule attributeID="uid">          <afp:PermitValueRule xsi:type="basic:ANY" />    <  /afp:AttributeRule>
</afp:AttributeFilterPolicy>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130628/be3fe635/attachment.html