Unencrypted NameID

[Robert Lamothe]

I have not doubt that I'm misunderstanding, documentation seems very incomplete so I'm struggling through this at every step.  

Ok, so how do I do this?  The vendor is using NameID and wants it to be unique, they're recommending it be the email address.   This suggests that I can override NameID per SP, if so, how do I do this?
Thanks-Bob
--
Bob Lamothe
robert_lamothe at yahoo.com
KB1BOB
603-918-6336

 

    On Tuesday, February 2, 2016 4:26 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 >    I'm new to shib so my understanding is evolving by the hour, so if I make
> no sense with my questions please bear with me.

You're making a very common error, so don't be offended when the response is that you're completely misunderstanding what you're seeing.

>    I'm having a problem authenticating to an SP who's service we've
> contracted.  When I had idp.encryption.optional set to false, we got the error
> SAML failed to login, Status code is
> urn:oasis:names:tc:SAML:2.0:status:Responder. When it is supposed to be
> urn:oasis:names:tc:SAML:2.0:status:Success

If the SP doesn't have a key, you can't do XML encryption. You can either use that optional flag or explicitly disable encryption for that relying party with an override in relying-party.xml

This has nothing to do with NameIDs in any way.

>    When I set idp.encryption.optional to true I can authenticate against my
> Shib server but then it looks like NameID is coming through encrypted.

No. That's a transientID, it's opaque. There are two ways to generate them. Both are opaque. Neither are encrypted in the sense you're thinking about. They are only used to provide a handle to an SP for making logout requests.

If an SP requires a NameID in a different form, then you can't use transient. That still has nothing to do with encryption, or with the property you're looking at.

> Based on some reading I've done it appears that NameID is encrypted if end
> to end encryption can't be assured,

It is not. The assertion would be encrypted, not the NameID alone, and it can't be because there's no key in the metadata, or it would be working.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160202/ea5feed6/attachment.html>