SAML Salesforce Reponse coming in Transient Format

Tue Nov 17 15:39:01 EST 2015

I'm trying to understand this and am looking at the metadata for one of
our SP's.

What part of this SP metadata tells our Shib IdP which NameID format to
select?

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_456789987b9c1c0c917e2fe4379f68ea45678987"
entityID="https://xxxxxxxxxxxxxcom">

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
    <alg:DigestMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <alg:DigestMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
  </md:Extensions>

  <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
    <md:Extensions>
      <init:RequestInitiator
xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/Login"/>
    </md:Extensions>
    <md:KeyDescriptor>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyName>rd00155de1e7c0</ds:KeyName>
        <ds:X509Data>
          <ds:X509SubjectName>CN=rd00235de1e7ff</ds:X509SubjectName>
          <ds:X509Certificate>xxxxxxx==</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2009/xmlenc11#aes192-gcm"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep"/>
      <md:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
    </md:KeyDescriptor>
    <md:ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/Artifact/SOAP"
index="1"/>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/SOAP"/>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/Redirect"/>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/POST"/>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/Artifact"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/POST"
index="1"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/POST-SimpleSign"
index="2"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/Artifact"
index="3"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/ECP"
index="4"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML/POST"
index="5"/>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML/Artifact"
index="6"/>
  </md:SPSSODescriptor>

</md:EntityDescriptor>

--Clayton

"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it at sneakemail.com> on
Friday, November 13, 2015 at 3:34 PM -0500 wrote:
>On 11/13/15, 3:14 PM, "users on behalf of Cahill, Charles (GE
>Appliances)"  wrote:
>>I am still really confused on this. I changed the nameid-format to
>persistent, but it
>>is still coming back in the saml response as transient.
>I don't know what that means or what you changed.
>There is configuration for generating NameIDs in various formats as
>required, and then you have machinery in various places that controls the
>selection of the format, principally the SP's metadata.
>Beyond that it depends on the version.
>V3
>https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration
>V2 (much harder to follow, but that's what you get for running code a
>year or more out of date)
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
>-- Scott
>-- 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151117/f6348780/attachment-0001.html>