ComputedID, eduPersonTargetedID in IdPv3

[Karla Borecky]

We are currently releasing eduPersonTargetID to Hathitrust in our v2 IdP.

If I want the legacy ComputedID definition to work, do I have to uncomment
the '#idp.nameid.saml2.legacyGenerator =
shibboleth.LegacySAML2NameIDGenerator' line in the saml-nameid.properties
file?

Wouldn't doing that mean it will also ignore new-style configuration things
I've defined elsewhere (in relying-party or saml-nameid.xml)?  Because I
can't have that.

If so, then how do we redo this config bit from v2?

   <resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
id="eduPersonTargetedID"
       nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
sourceAttributeID="computedID">
        <resolver:Dependency ref="computedID" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
/>
    </resolver:AttributeDefinition>

Would it be something like:

In attribute-resolver:

<resolver:AttributeDefinition id="persistentNameIdSourceUid"
xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="myChosenAttribute">
    <resolver:Dependency ref="directory" />
  </resolver:AttributeDefinition>

In saml-nameid.properties:

idp.persistentId.sourceAttribute = persistentNameIdSourceUid
[...other computed ID lines...]

In saml-nameid.xml:

Use the shibboleth.ComputedPersistentIdGenerator bean - though I am having
trouble finding an actual example of the syntax for this guy. (The only one
I've messed with is the SAML2AttributeSourcedGenerator.) This would be my
first stab at it, using the urn:oid for the eduPersonTargetedID:

<bean parent="shibboleth.ComputedPersistentIdGenerator"
  p:format:="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"

Even so, this doesn't tell me what I would put in the attribute resolver
for this attribute.

I really would rather not play Guess The Syntax. ;-)  So if anyone has an
actual example of how they've done this... or if anyone could tell me if
it's even possible? If it's not possible, then I'm afraid my users' saved
Hathitrust searches (or whatever) are not going to be there because I'm
going to have to go to using eppn.

Thanks. Sorry this is so long.
Karla B




-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160309/d1af8368/attachment-0001.html>