NameID Format Generation

[Michael Dahlberg]

On Fri, Feb 26, 2016 at 2:35 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Also, this Attribute Definition is leftover from the v2 to v3 upgrade
>
> >         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> > nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-
> > format:WindowsDomainQualifiedName" />
>
> That constant is wrong. That constant is NOT about SAML version. It is
> defined in SAML 1.x and that is the constant. The above is undefined. That
> is the root of your mess.
>
> Commented this and all other NameID formatters out the resolver.



> > (2) Modified the saml-nameid.xml to generate the format:
>
> Pick the V2 way or the V3 way. If you use the V3 way, there is no
> attribute encoder involved.
>
>
I decided to go with the V3 method.


> > <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-
> > format:WindowsDomainQualifiedName</NameIDFormat>
>
> And here you have the wrong constant, which doesn't match.
>
>
And returned the NameIDFormat line to

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>


Unfortunately, it's still dropping through to transient formatting:

 <saml2:Subject>
            <saml2:NameID
                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                NameQualifier="https://shib.bucknell.edu/idp/shibboleth"
SPNameQualifier="bucknell.maps.arcgis.com
">AAdzZWNyZXQxzwuMlkEnBpBZ83uwehs32gAcJIEBDeVznWVXIYlpmAnl7zbv+WcWtkq2Sr0s/l51pRvXEe59LdR/+4ZcLoM3ArLc01u79MRKoxmQm9grGdqogKB6zg6+4WEO/MFvoc4=</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="134.82.79.6"
                    InResponseTo="_MhLgXiDjbZZjVJkL"
                    NotOnOrAfter="2016-02-26T20:47:43.951Z" Recipient="
https://bucknell.maps.arcgis.com/sharing/rest/oauth2/saml/signin"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>


Based on what I've provided, should the nameid-format be set to
WindowsDomainQualifiedName?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160226/503e647c/attachment.html>