IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Le 18/10/2013 22:35, Peter Schober a écrit :
> * Jehan Procaccia <Jehan.Procaccia at it-sudparis.eu> [2013-10-18 16:01]:
>> I still want to send my email address as the NameIdentifier for that
>> SP, not the default transientId, how can I force my shibboleth IDP
>> to do so ?
> Undo what you did so far with regard to NameIDs and start with the
> documentation:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
> More specifically, with a complete example to follow:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier
>
> I.e., create a new attribute defintion, use whatever data you want as
> sourceAttributeID (e.g. "email"), adjust the dependency to match the
> dataconnector the sourceAttributeID comes from, and use the rest of
> the example pretty much verbatim.
>
> Then release that attribute to the SP in question, as in the example,
> also adding a DenyValueRule for transientId to that same
> AttributeFilterPolicy.
>
> That's all there is to it.
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
OK, I recreated the attribute definition from tha sample  according to
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier 

moreover corrected the attribute filter with denying any value for 
transientId so that for that SP it is for sure that new NameID that is sent
and now that works fine ;-)
thanks a lot for your help !

for the record, here's my final config

Attribute-resolver:
       <!-- nameID for travel -->
<resolver:AttributeDefinition id="travelId" xsi:type="Simple" 
sourceAttributeID="mail"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
<resolver:Dependency ref="ldapTMSP" />
<resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>

Attribute-filter:

<AttributeFilterPolicy id="releaseNameIDtoTravel">
         <PolicyRequirementRule xsi:type="basic:OR">
             <basic:Rule xsi:type="basic:AttributeRequesterString" 
value="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp" />
             <basic:Rule xsi:type="basic:AttributeRequesterString" 
value="https://www-public.it-sudparis.eu/shibboleth" />
         </PolicyRequirementRule>
     <!-- deny transientID for that SP so that only the new NameID 
"travelID" is sent. -->
          <AttributeRule attributeID="transientId"><DenyValueRule 
xsi:type="basic:ANY" /></AttributeRule>
         <AttributeRule attributeID="travelId"><PermitValueRule 
xsi:type="basic:ANY" /></AttributeRule>
</AttributeFilterPolicy>

associated IDP-process.log when login in that SP

20:56:50.865 - INFO [Shibboleth-Access:73] - 
20131020T185650Z|81.233.30.35|idp.int-evry.fr:443|/profile/Shibboleth/SSO|
20:56:58.369 - INFO [Shibboleth-Access:73] - 
20131020T185658Z|81.233.30.35|idp.int-evry.fr:443|/profile/Shibboleth/SSO|
20:56:58.431 - INFO [Shibboleth-Audit:745] - 
20131020T185658Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.int-evry.fr/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_ee9bc4a770e2093c9547a6bcdf2be8a4|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|supannEtablissement,email,travelId,|jehan.procaccia@tem-tsp.eu|_69fea1079b62bbcbc1a2c75da4246849,|

self crafted metadata for that SP

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" 
entityID="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp">
   <md:SPSSODescriptor 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol 
urn:oasis:names:tc:SAML:1.0:protocol">
  <md:KeyDescriptor>
             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                     <ds:X509Data>
<ds:X509Certificate>MIIFQzCCBCugAwIBAgISESGAsnNiaZY0Qt2yp+Mpwna7MA0GCSqGSIb3DQEBBQUA
                                 ...............
                                 ...............
                             heUmVjCuYA==</ds:X509Certificate>
                                       </ds:X509Data>
                                             </ds:KeyInfo>
</md:KeyDescriptor>
<md:AssertionConsumerService 
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" 
Location="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp" 
index="1"/>
<md:AssertionConsumerService 
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" 
Location="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp" 
index="2"/>
                  </md:SPSSODescriptor>
          </md:EntityDescriptor>

URL called from the browser to in initiate the SSO from the IDP before 
going to the SP (IDP initiated)

https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp