IdPv3 and generating persistent NameID

[Cantor, Scott]

On 4/30/15, 4:00 PM, "Sara Hopkins" <sara.hopkins at ed.ac.uk> wrote:

>I'm trying to get my v3 test IdP to release persistent NameIDs as per the documentation here:
>
>https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration
>
>But I'm having trouble getting it working. I assume that if it works I should see a saml2:NameID with Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" in the SAML 2 assertion; is that correct?

The assertion will contain a NameID in whatever it decides is the right Format for that request. Configuring the plugin is necessary but not sufficient. That lets it successfully do persistent if it thinks it should, but it will always default to transient unless the default format property is changed or something overrides the default.

>I have an attribute definition in attribute-resolver.xml for the source attribute "uid", and an attribute-filter.xml rule to release the source attribute "uid" to the SP.
>
>When I log into the SP I can see that the "uid" attribute is in the assertion, but I can't see anything that looks to me like a persistent NameID.

If you're sending a persistentID, you want to use a source attribute that has no encoders attached to it so that it doesn't leak. I'll be changing the defaults to reflect that better. It's not ideal, but we'll see how it goes.

But as far as what's there, if it's a transient NameID, then nothing told it to use a non-default format. Put the format you want in the SPs metadata and it should switch.

-- Scott