IdPv3 and generating persistent NameID

[Walter Forbes Hoehn (wassa)]

An example of the sort of thing that Scott described follows….

In attribute-resolver.xml:

<resolver:AttributeDefinition id="uid" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="uid">
    <resolver:Dependency ref="directory" />
    <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:uid" />
    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
  </resolver:AttributeDefinition>

  <resolver:AttributeDefinition id="persistentNameIdSourceUid" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="uid">
    <resolver:Dependency ref="directory" />
  </resolver:AttributeDefinition>

In saml-nameid.properties:

idp.persistentId.sourceAttribute = persistentNameIdSourceUid


> On Apr 30, 2015, at 4:07 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 4/30/15, 4:00 PM, "Sara Hopkins" <sara.hopkins at ed.ac.uk> wrote:
> 
>> I have an attribute definition in attribute-resolver.xml for the source attribute "uid", and an attribute-filter.xml rule to release the source attribute "uid" to the SP.
>> 
>> When I log into the SP I can see that the "uid" attribute is in the assertion, but I can't see anything that looks to me like a persistent NameID.
> 
> If you're sending a persistentID, you want to use a source attribute that has no encoders attached to it so that it doesn't leak. I'll be changing the defaults to reflect that better. It's not ideal, but we'll see how it goes.
>