IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Le 16/10/2013 19:48, Kevin P. Foote a écrit :
> On Wed, 16 Oct 2013, Jehan Procaccia wrote:
>
>> <resolver:AttributeDefinition id="email" xsi:type="Simple"
>> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>>          sourceAttributeID="mail">
>>          <resolver:Dependency ref="ldapTMSP" />
>>          <resolver:AttributeEncoder xsi:type="SAML1String"
>> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>>              name="urn:mace:dir:attribute-def:mail" />
>>          <resolver:AttributeEncoder xsi:type="SAML2String"
>> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>>              name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
>>      </resolver:AttributeDefinition>
>>
>> So if I understood well, that attribute name is "email" (not mail right !?)
>> it's nameFormat is either SAML1String or SAML2String
>> and it's not a NameID .
>>
>> If I want it to become a NameID it must be of type
>> xsi:type="SAML2StringNameID" , but is it possible to sent multiple
>> NameID attributes, my IDP already sends
>> AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"
> Of the available attributes that are encoded to the proper NameID Format
> during the resolution and release phase, the Shib IdP will only pick one
> to send as the NameID of the assertion.
>
> Stated differently you can attach NameID encoders to multiple attribute
> definitions during the resolver stage.  During the filtering and release
> stage a single NameID value will be chosen from the pool of available
> attributes that can be released to a given RP.
>
> You can force which one is chosen by limiting the available attributes
> at release or using the precedence capabilities (see Selection Process
> linked below).
>
> <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier>
>
> ------
> thanks
>    kevin.foote
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
following your recommendations, I created a custom NameID for that vendor,
but I still cannot figure out how to use a "precedence capability" to 
ensure that for that vendor, it is that custom NameID that is released
below in bold  are my IDP released  4 attributes

22:09:39.847 - INFO [Shibboleth-Audit:745] - 
20131017T200939Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.int-evry.fr/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_207ae3af9497eb3b439b2a5ba82ed018|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|*supannEtablissement,transientId,email,travelId,*|_8ac27ab82e7a98e91805eb952eb2657e|_0d67aca402980281b44bfc8fabd792ee,|

according to my attribute-resolver custom NameID

        <!-- nameID for travel ID-->
<resolver:AttributeDefinition id="*travelId*" xsi:type="Simple" 
sourceAttributeID="mail"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"> <resolver:Dependency 
ref="ldapTMSP" />
     <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
     xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>

my attribute-filter

  <AttributeFilterPolicy id="releaseTransientIdToAnyone">
         <PolicyRequirementRule xsi:type="basic:ANY" />
         <AttributeRule attributeID="transientId"> <PermitValueRule 
xsi:type="basic:ANY" /></AttributeRule>
         <AttributeRule attributeID="supannEtablissement"> 
<PermitValueRule xsi:type="basic:ANY" /></AttributeRule>
         <AttributeRule attributeID="mail"> <PermitValueRule 
xsi:type="basic:ANY" /></AttributeRule>
         <AttributeRule attributeID="travelId"><PermitValueRule 
xsi:type="basic:ANY" /></AttributeRule>
     </AttributeFilterPolicy>

How can I make that travelID be THE nameID dir that SP , while still 
keep transientId for other SPs ?

Thanks .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131017/9fb3d1ad/attachment.html