IdP: Returning NameId encrypted in SAMLResponse Assertion

[Kevin Foote]

Hi Suresh,
It is not clear if you are the IdP operator or the SP operator or both, so I'm not sure what you have access to change.

Encrypting the nameid is controlled in the relying-party.xml config on the IdP. I believe the default is set to "never" in recent (2.4+) releases. You will want to verify the RP config for that SP is set to never.

About two weeks ago there was a similar thread.. You can search for it.

- sent from mobile

On Oct 23, 2014, at 2:08 AM, Suresh Babu <Suresh.Babu at ibsplc.com<mailto:Suresh.Babu at ibsplc.com>> wrote:

Hi All,

I am getting user principle always encrypted. I have specified nameid-format:unspecified which is not supposed to encrypt the username. For populating the user details on SP using SAML Credentials I need this unecrypted.
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" NameQualifier="https://b1035.ibsplc.com:8443/idp/shibboleth">_c6c2e2ea8bc2cbce298ebf895721bdf7</saml2:NameID>

I am using jaasConfiguration for authentication from our local database. Configuration changes made to get unspecified in metadata.xml (but not getting funcationality)
$IDP_HOME/conf/Attribute-resolver.xml
<resolver:PrincipalConnector xsi:type="pc:Transient" id="saml1Unspec" nameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>

<resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
  <!-- <resolver:AttributeDefinition id="transientId" xsi:type="ad:Simple"> -->
   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />

Please help me out for getting the username unencrypted.

Thanks in advance!
Suresh


DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect."
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141023/a875900f/attachment.html