How to configure a transparent custom NameID to "accomodate a vendor with a lousy SAML implementation" in IdP v3

[Alan Angulo (Office365 admin)]

This is my contribution to those that are struggling with vendors requiring a "clear text" NameID using IdP v3

Assumptions:
o- You have configured jetty with the appropriate cert.

Pre-Conditions:
0. Vendor is asking the assertions to be IdP initiated.
1. Vendor is asking for non-encrypted assertions.
2. Vendor is asking for the NameID to be the same as the authenticated username.
3. Vendor is asking the NameID to be in "clear text" (custom, non-opaque/transparent)

System Environment:
o- Windows Shibboleth IdP v3.1.2 configured with Active Directory during installation.
o- You can edit the vendor's metadata (VendorMetadata.xml)

Solution:
All you have to do is create a custom transparent Name Identifier using the WindowsDomainQualifiedName format:


------------------------------
VendorMetadata.xml:
------------------------------
<EntityDescriptor entityID="VendorXYZ" ... >
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" 
						WantAssertionsSigned="false" 
						EncryptAssertions="never">
...
          <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
          <AssertionConsumerService isDefault="true" 
								index="0" 
								Location="https://sp.vendorxyz.com/VendorSamlApp"
								Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
</SPSSODescriptor>


------------------------------
Relying-Party.xml:
------------------------------
...
        <bean parent="RelyingPartyByName" c:relyingPartyIds="VendorXYZ">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>
...


------------------------------
Attribute-Filter.xml
(note: attribute "uid" is already pre-defined in the resolver)
------------------------------
...
<afp:AttributeFilterPolicy id="NameIDForVendorXYZ">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="VendorXYZ" />
        <afp:AttributeRule attributeID="uid">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
</afp:AttributeFilterPolicy>
...


------------------------------
saml-nameid.xml:
------------------------------
<util:list id="shibboleth.SAML2NameIDGenerators">
...
      <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName"
            p:attributeSourceIds="#{ {'uid'} }" />
...
</util:list>


Once you have finished configuring, rebuild it (using the ...\bin\build.bat batch file that came with the installation) and issue the following URL from your IdP browser: https://MyIdP.esu.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=VendorXYZ



Alan Angulo
Systems Administrator
East Stroudsburg University
alan at live.esu.edu