IdP: Returning NameId encrypted in SAMLResponse Assertion

[Cantor, Scott]

On 10/23/14, 5:08 AM, "Suresh Babu" <Suresh.Babu at ibsplc.com> wrote:

>Hi All,
> 
>I am getting user principle always encrypted.

No, you're not. I'm pretty sure I said that exact thing a few weeks ago.
Transient IDs are not ecnrypted, they're just opaque. If you don't want a
transient ID, then don't use that plugin.

> I have specified
>nameid-format:unspecified which is not supposed to encrypt the username.

Both of those statements are false. Using unspecified is never the correct
choice, and even if it were, by definition it is *unspecified*, which
means that it says nothing whatsoever about what the NameID content means
or what it might look like. That's precisely why it's a very bad choice.

> For populating the user details on SP using SAML Credentials I need this
>unecrypted.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

>I am using jaasConfiguration for authentication from our local database.
>Configuration changes made to get unspecified in metadata.xml (but not
>getting funcationality)

That uses the same algorithm as before to generate a transient ID and then
slaps a different Format value in to it.

> 
>Please help me out for getting the username unencrypted.

Choose a standard Format to use, or mint a URL to represent what you want.
Generate the value you want in an AttributeDefinition. Attach a
SAML2StringNameID encoder to that definition. Release that attribute
defintion's ID in a filter policy for that SP. Put the NameID Format
selected into the SP's metadata.

-- Scott