Need help with canonicalization and attribute resolver in a mutual auth scenario.

[Cantor, Scott]

On 7/14/15, 12:00 PM, "users on behalf of Johan Åkerstrøm" <users-bounces at shibboleth.net on behalf of Johan.Akerstrom at skill.no> wrote:

>In the SSO tracer I see  no NameID or other attributes.

Well, that's a matter of NameID generation config and attribute resolver/filter config, as it used to be. Has nothing particularly to do with use of X.509, really, in most cases. The documentation on all that is in the wiki, but I describe some specific cases below.

> So to my questions….
> 
>How do I copy the CN of the subject from the x509 certificate into NameID?

First you need to separate in your mind the issue of what the canonical principal name is after authentication from what ends up in a NameID. They don't have to be related.

If you *want* the canonical principal name to be the CN, then you would first configure the c14n/x500 flow to do that work for you by telling it to do that, but I believe that's the default (I think the CN OID is 2.5.4.3, and that's the default attribute it pulls from in c14n/x500-subject-c14n-config.xml. So that should be done for you.

Getting that into a NameID generally involves creating an attribute definition in the resolver that pulls from the principal name (there's an attribute definition type of Principal for that purpose), and releasing that attribute to the SP. Then you can follow the docs in the NameIDGenerationConfiguration page that describe how to do custom NameID format handling, and there's an example in the saml-nameid.xml file for that.

Using the NameID is not recommended however.

>How do I use the whole subject (which corresponds to an LDAP distinguished name) from the certificate to lookup other attributes or group memberships in our LDAP directory?

Somewhat oddly, I don't think the built-in code actually has the option to set the canonical name based on the whole DN, because DNs are pretty awful and people don't use them much. So you would first have to build a scriptlet in the resolver in an attribute definition to pull the DN directly out of the Java Subject. Once that's done, you can plug that in as a dependency into a DataConnector to fill in part of the search filter template.

If you want to file a RFE to get the DN populated as the canonical principal name, feel free, that seems like an oversight.

-- Scott