ComputedID, eduPersonTargetedID in IdPv3

[Cantor, Scott]

On 3/9/16, 2:33 PM, "users on behalf of Karla Borecky" <users-bounces at shibboleth.net on behalf of kborecky at smith.edu> wrote:



>If I want the legacy ComputedID definition to work, do I have to uncomment the '#idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator' line in the saml-nameid.properties file?

An upgrade should already have that uncommented, a new install won't.

The legacy feature is about the generation of NameID elements in a SAML subject. It is *not* about generating attributes that have a NameID element in the AttributeValue of an Attribute.

>Wouldn't doing that mean it will also ignore new-style configuration things I've defined elsewhere (in relying-party or saml-nameid.xml)?  Because I can't have that.

No, enabling the legacy generators means that if nothing else steps in to generate a NameID in a particular format, it will poke into the resolved IdPAttribute collection and look for a deprecated AttributeEncoder that knows how to generate a NameID instead of an Attribute. Primarily the SAML1/SAML2StringNameID encoder types.

>If so, then how do we redo this config bit from v2?

You can't, and ideally you should get rid of it and replace it with a SAML 2 persistent NameID in the subject.

The legacy bit has nothing to do with that approach, doesn't replace it, and we have no replacement for it because we don't want people to ever do it again.

>Would it be something like:

That would generate a SAML 2 persistent NameID, yes. It's not the same as what you posted.

>Use the shibboleth.ComputedPersistentIdGenerator bean - though I am having trouble finding an actual example of the syntax for this guy.

There is no syntax to add, the bean reference that's there is all you need, and you don't touch it. It knows about the only Format that is relevant to it, the "persistent" Format in SAML.

Generally speaking, as the documentation says, you don't need to edit any XML to configure transient or persistent NameID usage. There are properties for most of that.

There are no new methods for generating what you're asking about, it's just a deprecated capability.

-- Scott