Idp 3.x persistentId / shibsp-plugin-AttributeQuery-Handler

[Cantor, Scott]

On 3/31/15, 9:48 AM, "Raffael Sahli" <sahli at gyselroth.com> wrote:
>
>Switch[1] describes the persistent attribute as a triple like:
><name for the source of the identifier>!<name for the intended audience of the identifier >!<opaque identifier for the principal >

A persistent ID is at its core a SAML NameID XML element. How it gets turned into a string is a local consideration, but I can't tell you what that code is doing or what it will end up passing in some parameter. I can speculate, but that's about it.

>I have read the following wiki article:
>https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration
>
>and configured saml-nameid.properties:
>  idp.persistentId.sourceAttribute = persistentId
>  idp.persistentId.salt = ***

Well, the requirements for getting that to work are to set those properties, produce an actual attribute from the resolver by the name of the sourceAttribute (and I strongly advise against calling it persistentId, that's horrendously confusing), and then make sure that sourceAttribute is released to the relevant SP(s).

After all of that, you still need to manipulate metadata or configuration to get the "persistent" NameID Format used in the transaction. The simplest way is to embed the appropriate NameIDFormat element in the SP's metadata or configure it to request the right Format in its AuthnRequest.

-- Scott