Question about webex and nameid format

[Joy Veronneau]

Hi,

I have a working webex implementation with Shibboleth 2.3.3 and java 1.5. I am trying to complete an upgrade to Shibboleth 2.4 and java 1.7.

When I do the upgrade in my test environment, things seem to work ok except for the webex configuration.

The shib 2.3.3 debug log shows this:
14:35:45.085 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:483] - Name identifier for relying party 'http://www.webex-test.com' will be built from attribute 'webexID'

while under 2.4 (and 2.3.8), the debug log shows this:
12:07:31.903 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:850] - Using attribute 'transientId' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party 'http://www.webex-test.com'

I am not sure why this would be? It must be a config issue somewhere but I can't find it.  I want it to send webexID in format unspecified, not transientId in format transient.

Thanks,

Joy
-------------------------------

relying-party.xml

<rp:RelyingParty id="http://www.webex-test.com"
              provider="https://shibidp-test.cit.cornell.edu/idp/shibboleth"
              defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" signAssertions\
="never"
/>
</rp:RelyingParty>

[...]
<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                   id="WEBEXTEST"
                   metadataFile="/app/shibboleth/shibboleth-idp/metadata/webext-md.xml" />
[...]
--------------------------
webext-md.xml:
[...]
<md:NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
<md:NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:entity</md:NameIDFormat>
<md:NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://cornelltest.webex.com/dispatcher/SAML2AuthService?siteurl=cornelltest" index="0" isDefault="true"/>
</md:SPSSODescriptor>

[...]

----------------------
attribute-resolver.xml:

   <resolver:AttributeDefinition id="webexID" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="uid">
     <resolver:Dependency ref="myLDAP" />

     <resolver:AttributeEncoder xsi:type="SAML1String"     xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            name="urn:mace:dir:attribute-def:uid" />

     <resolver:AttributeEncoder xsi:type="SAML2String"     xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
            name="uid" />

     <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"  />

   </resolver:AttributeDefinition>

-------------------
attribute-filter.xml:
 <AttributeFilterPolicy id="WEBEXTEST">
    <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="http://www.webex-test.com" />
    <AttributeRule attributeID="webexID">
      <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>

  <AttributeRule attributeID="firstname">
      <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>

  <AttributeRule attributeID="lastname">
      <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>

  <AttributeRule attributeID="WEBEXemail">
      <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>

</AttributeFilterPolicy>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130906/8c774004/attachment.html