a simple recipe for copying attribute into Subject/NameID

[Peter Schober]

* Jason Winshell <jason at jasonwinshell.com> [2013-06-29 02:46]:
> I've spent way too many hours trying to accomplish this simple task
> uid=>NameID problem. I'd like it both as an attribute and in
> NameID. I could really use some practical help.
[...]
> In attribute-resolver.xml:
> 
>      <resolver:AttributeDefinition xsi:type="ad:Simple"
>         id="uid" sourceAttributeID="uid">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid" friendlyName="uid" />
>         <!-- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /> -->
>     </resolver:AttributeDefinition>

You need an active enc:SAML2StringNameID type encoder if it should end
up as a NameID (assuming SAML2). Then add a proper nameFormat to it
(only "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" comes to
mind for uid).

> <!-- BTW, I have no idea why I need transientId. But I found that
> without it there was nothing in the Subject/Name -->

Leave it in the resolver, as in the default config. Later in the
processing you can chose not to release it (as there can only be one
NameID in the assertion).

> In attribute-filter.xml:
> 
>    <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
>         <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
> 
>         <afp:AttributeRule attributeID="transientId">
>             <afp:PermitValueRule xsi:type="basic:ANY"/>
>         </afp:AttributeRule>
> 
>        <afp:AttributeRule attributeID="uid">
>           <afp:PermitValueRule xsi:type="basic:ANY" />
>     <  /afp:AttributeRule>
> 
>     </afp:AttributeFilterPolicy>

Leave that rule as it was before (i.e., remove your own uid rule from
it) as it wont do anything sensible this way: Releasing more than one
NameID to the same relying party at the same time cannot work, so
having both in the same rule applied to /any/ relying party makes no
sense.

See the end of
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
for the "IdP Name Identifier Selection Process".
So either create a precendence list (only makes sense if you have
several SPs and want a generally applicable predence of NameID types
established) as documented or -- much simpler, IMO -- create a rule
that will release your NameID and suppresses the release of the
transientId one at the same time (assuming you have an active default
rule that releases transientId to everyone). E.g.

<afp:AttributeFilterPolicy id="uidAsNameID">
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://sp.example.org/saml" />
    <afp:AttributeRule attributeID="uid">
        <afp:PermitValueRule xsi:type="basic:ANY" />
    </afp:AttributeRule>
    <afp:AttributeRule attributeID="transientId">
        <afp:DenyValueRule xsi:type="basic:ANY" />
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>

-peter