ArcGIS on Shib 3

[Peter Schober]

* McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-06-25 15:24]:
> Unable to login using Idp User name is invalid, we are not able create 
> this 
> 'AAdzZWNyZXQxM5JTIOlSYqZoH/iR0kKuxuDJU3xpBoZEjVIvDiPh9waP1uzFxFuDDSRuyQ
> ropDch4QqkOuNKlqHkVwRsFKvSYGOlviHTzqTAurhwZoFYrIwghICM6scHxePa'
>  in our system
> From what I can tell from the SAML Tracer results, the part corresponds
> with what's in the NameID section:
> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid
> -format:transient"
>                           NameQualifier="https://it
> -federation2.jmu.edu/idp/shibboleth"
>                           SPNameQualifier="JMU.maps.arcgis.com"
>                          
> >AAdzZWNyZXQxXb/rYm+ZcnLKv3HiQasbsmUCyznIMh4K2vAcCpEc6+BQm3kwBsjsKYJjVt
> nK6f6OGA5rWbejVo7Xh8SCKIKYhPLBUORj2gGOOUFC8pvywaocc5FDw71icBw+</saml2:N
> ameID>

That's a rather long transientId, is that IDPv3's default?
Anyway the vendor uses the NameID to identify the subject, so
transient is a bad choice for that (as it will be different even for
the same subject a couple of minutes later, and so would fill up the
application's database:
"When a user from the IDP signs in, a new user with the user name
NameID_<url_key_for_org> will be created by ArcGIS Online in its user
store."

> As I understand it, they need this to be in plaintext, and they believe
> this result to be indicative of encryption being enabled, even though I
> have encrypted assertions off and NameID encryption isn't default
> anymore in Shib 3.

Transient NameIDs are just meaningless ugly opaque strings, they're
not encrytepd.

So your next step would be to decide on the type of NameID to send
them, instead of transient. Persistent is one choice (and will not
change for a given subject, unless you decide that's what you want)
but needs IDM processes in place to be able to support it properly.
Email address as NameID is also a possibilty, if that matches your
(and the application's) expectance of stability/persistence.

See this page for everything you ever wanted to know about NameIDs:
https://wiki.shibboleth.net/confluence/display/CONCEPT/NameIdentifiers
-peter