NameID Format

[Michael Dahlberg]

Scott, David and Jeff:

Thanks for your patience.  I believe the formatting is now correct, I'm
just having problems releasing the correct data.

Following the guides at
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier
and https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier,
I'm trying to a custom Name Identifier that release the email address of
the authenticated user.  To that end I've made the following config
changes:  In the resolver, I have the following

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail"
sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:mail" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
    </resolver:AttributeDefinition>


    <resolver:AttributeDefinition id="userEmail"
xsi:type="ad:PrincipalName" sourceAttributeID="mail" >
        <resolver:Dependency ref="mail" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>


In the metadata for this particular SP, I do have the appropriate
NameIDFormat specified:

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>


And I am releasing the attribute in the attribute-filter file:

    <afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="benefitfocus.com:sp" />

        <afp:AttributeRule attributeID="userEmail">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

My problem is that the NameID thats being returned to the SP is "dahlberg"
when it should be "dahlberg at bucknell.edu":

 <saml2:Subject>
            <saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

NameQualifier="https://shib.bucknell.edu/idp/shibboleth"
                          SPNameQualifier="benefitfocus.com:sp"
                          >dahlberg</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.20.10.105"

InResponseTo="b-sydCYHQXsqeRA_XjltoqcNrzA"

NotOnOrAfter="2015-10-01T16:10:21.921Z"

Recipient="https://testsp.benefitfocus.com/sp/ACS.saml2"
                                               />
            </saml2:SubjectConfirmation>


Any Idea where I'm going wrong?


Thanks,

Mike



On Wed, Sep 30, 2015 at 4:45 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/30/15, 4:26 PM, "users on behalf of Michael Dahlberg" <
> users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:
>
> >Yes, my apologies.  Of course, I am releasing that attribute in the
> attribute-filter.xml file:
>
> I know, but that's got nothing to do with format selection. There are
> historical reasons why people conflate them, but they haven't been related
> in many, many years and there is nothing I mentioned to that does so. All
> you have to do is release the attribute involved, the rest is about format
> selection.
>
> >I appreciate the description of a persistent identifier but I don't know
> how it is used, what it releases, or where it releases it in the SAML
> payload.  I usually stop reading that particular page at that point.  I
> agree, I should continue on.
> >
>
> The specific documentation section I pointed to doesn't say anything about
> any particular formats (aside from calling out the issue with
> "unspecified"), certainly not that one.
>
> >I'm not sure how I would know that there "is not an e-mailAddress
> nameFormat unique to SAML 2.0" and what effect changing that nameFormat has
> on what is released, how it is released and where it is released..
>
> If you want a book on SAML, that's not within my willingness to produce,
> not and still have a life. But the core standard is not that long  and the
> section on NameID Formats is near the end and is very short. That's all
> that's defined. Email address happens to be one of the predefined formats.
>
> >Given that I am releasing the cnIdentifiedName in the attribute-filter,
> that other attributes can be released without blocking the transientID,
> would there be any other reason why the transientID is released and not the
> cnIdentifiedName?
>
> You can hack things into submission by blocking the release of transientId
> as an attribute for just that SP so that the total set of candidate NameIDs
> is down to one, the one you want. The *right* way is documented in what I
> sent, you either put the Format you want into the SP's metadata, or if
> that's not practical you put it into a RelyingParty override via
> nameIDFormatPrecedence.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151001/9fc818ad/attachment.html>