Persistent NameID Generation

[Michael Dahlberg]

I seem to be having a problem with persistent nameID generation.  One SP
that we work with requires that we release the employeeNumber as a
persistent nameID.  Our saml-nameid.properties file correctly lists the
idp.persistentId.sourceAttribute as the employeeNumber and a
idp.persistentId.salt value is specified.  The attribute employeeNumber is
correctly sourced and retrieved from the LDAP backend.  However, based on
this debug output, it looks as if the nameID is being *computed* from the
employeeNumber source attribute rather than the employeeNumber being just
*used* as the nameID

# Output

Profile Action AddNameIDToSubjects: Candidate NameID formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent]

Profile Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Trying to generate identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Checking for source attribute employeeNumber

Generating persistent NameID from String-valued attribute employeeNumber

Generating NameID 0E1J+15qGjrIiEpwxjXD0UdQr1s= with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Successfully generated identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Profile Action AddNameIDToSubjects: Successfully generated NameID with
Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Profile Action AddNameIDToSubjects: Added NameID to 1 assertion subject(s)

# end Output

Can't the source attribute just be used as the value for the persistent
nameID?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160831/755be054/attachment.html>