transient vs persistent custom nameids

[Liam Hoekenga]

Take a look at this thread -
http://marc.info/?l=shibboleth-users&m=144174395227466&w=2

We had similar situations in IdP v2 - where vendors / partners wanted us to
send our users' login IDs to them as transient and / or persistent nameIDs.

When we upgraded to IdP v3, we stopped allowing that, and have been working
with the various SPs to use "unspecified" nameIDs instead.

Liam


On Wed, Jan 27, 2016 at 2:00 PM, <brabec at ncsu.edu> wrote:

> We have a 3rd Party SP doing some kind of SAML2. They expect us to
> return the SAML NameID as urn:oasis:names:tc:SAML:2.0:nameid-
> format:transient with the value = our numeric campus id. This has been
> setup and working for us in V2 for a while now.
>
> In V3 saml-nameid.xml, I can do this:
>
>   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>       p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>       p:attributeSourceIds="#{ {'CampusId'} }">
>     <property name="activationCondition">
>       <bean parent="shibboleth.Conditions.RelyingPartyId"
>         c:candidates="#{{
>           'SPentityID'
>         }}" />
>     </property>
>   </bean>
>
> When I do, I see what looks like the automatic transient
> handler kicks in and writes something like this:
>
> <saml2:NameID
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">MIMEDATAHERE=</saml2:NameID>
>
> The SP accepts this, but sends me off to an account not found page.
>
> I can also change the same block to
>     p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>
> And the custom handler works as expected, returning:
>
> <saml2:NameID
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">012345678</saml2:NameID>
>
> But the SP refuses the message, because it is coded to look for
> Format="...:transient".
>
> Is there a bean / attribute I can add to the above to tell the generator
> to treat this is a persistent, but label it transient without using the
> transient generator in its place?
>
> Charles
>
> --
> All electronic mail messages in connection with State business which are
> sent to or received by this account are subject to the NC Public Records
> Law
> and may be disclosed to third parties.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/2bc84570/attachment.html>