transient vs persistent custom nameids

[brabec at ncsu.edu]

I swear I tested this a few times, but when I went back again it now
seems the SP doesn't actually care what the Format="" is set to.
This is really just an "unspecified" problem after all. Sigh.

Following the "unspecified" advice in the wiki, I used the URI
for employeeID in the name format for this SP, and it works.

Thanks, Scott and Liam, for the prompt replies kicking me to try 
again to do it right. Per Liam's thread, I will go revisit 
our Service Now configs next.

Here's the working configs if anyone else hits this particular SP.

relying-party.xml:
    <bean parent="RelyingPartyByName" 
          c:relyingPartyIds="#{{
            'benefitfocus.com:sp'
          }}">
        <property name="profileConfigurations">
            <list>
                <bean parent="SAML2.SSO" 
                      p:nameIDFormatPrecedence="urn:oid:2.16.840.1.113730.3.1.3"
                      p:signResponses="false"
                      p:encryptNameIDs="false"
                      p:encryptAssertions="false" />
            </list>
        </property>
    </bean>

saml-nameids.xml:
    <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oid:2.16.840.1.113730.3.1.3"
        p:attributeSourceIds="#{ {'CampusId'} }" />

Charles

On Jan 27, Cantor, Scott (cantor.2 at osu.edu) was heard to say:
> On 1/27/16, 2:00 PM, "users on behalf of brabec at ncsu.edu" <users-bounces at shibboleth.net on behalf of brabec at ncsu.edu> wrote:
> 
> 
> 
> >We have a 3rd Party SP doing some kind of SAML2. They expect us to
> >return the SAML NameID as urn:oasis:names:tc:SAML:2.0:nameid-
> >format:transient with the value = our numeric campus id. This has been
> >setup and working for us in V2 for a while now.
> 
> That isn't a proper use of that format.
> 
> >I can also change the same block to
> >    p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> 
> Also, though less, wrong to do that.
> 
> >Is there a bean / attribute I can add to the above to tell the generator
> >to treat this is a persistent, but label it transient without using the
> >transient generator in its place?
> 
> You would have to take out the built in transient generation beans, or attach an activation condition to them that tells them not to run if the SP matches the broken one.
> 
> I certainly not recommmend anything like that. You're making your life painful to accomodate a broken peer.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
All electronic mail messages in connection with State business which are
sent to or received by this account are subject to the NC Public Records Law
and may be disclosed to third parties.