Idp 3.x persistentId / shibsp-plugin-AttributeQuery-Handler

[Raffael Sahli]

Hi Scott

>>Switch[1] describes the persistent attribute as a triple like:
>><name for the source of the identifier>!<name for the intended audience of the identifier >!<opaque identifier for the principal >

>A persistent ID is at its core a SAML NameID XML element. How it gets turned into a string is a local consideration, but I can't tell you what that code >is doing or what it will end up passing in some parameter. I can speculate, but that's about it.

Ah ok, thanks for the explanation.


>>I have read the following wiki article:
>>https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration
>>
>>and configured saml-nameid.properties:
>>  idp.persistentId.sourceAttribute = persistentId
>>  idp.persistentId.salt = ***

>Well, the requirements for getting that to work are to set those properties, produce an actual attribute from the resolver by the name of the >sourceAttribute (and I strongly advise against calling it persistentId, that's horrendously confusing), and then make sure that sourceAttribute is >released to the relevant SP(s).

Okay, I will choose another name for it.
I have tried it before, but probably with a wrong encoder and probably a wrong attribute declaration :(

357     <resolver:AttributeDefinition id="persistentId" xsi:type="ad:Simple" sourceAttributeID="persistentId">
358         <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
359         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
360     </resolver:AttributeDefinition>

Because I get the following debug lines, and no attribute named persistentId in the saml response:

"
 2015-03-31 15:25:51,486 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'persistentId' remained after filtering

 2015-03-31 15:25:51,647 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:201] - Profile Action AddAttributeStatementToAssertion: Attribute persistentId did not have a usable SAML 2 Attribute encoder associated with it, nothing to do
"


>After all of that, you still need to manipulate metadata or configuration to get the "persistent" NameID Format used in the transaction. The simplest way >is to embed the appropriate NameIDFormat element in the SP's metadata or configure it to request the right Format in its AuthnRequest.

Hm, okay I will try that, thanks.



Raffael Sahli