ComputedID, eduPersonTargetedID in IdPv3

[Karla Borecky]

Thanks, Scott.

I just wish all the old syntax requests would go away. They are causing me
stress.

Karla

On Wed, Mar 9, 2016 at 2:33 PM, Karla Borecky <kborecky at smith.edu> wrote:

> We are currently releasing eduPersonTargetID to Hathitrust in our v2 IdP.
>
> If I want the legacy ComputedID definition to work, do I have to uncomment
> the '#idp.nameid.saml2.legacyGenerator =
> shibboleth.LegacySAML2NameIDGenerator' line in the saml-nameid.properties
> file?
>
> Wouldn't doing that mean it will also ignore new-style configuration
> things I've defined elsewhere (in relying-party or saml-nameid.xml)?
> Because I can't have that.
>
> If so, then how do we redo this config bit from v2?
>
>    <resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
> id="eduPersonTargetedID"
>        nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> sourceAttributeID="computedID">
>         <resolver:Dependency ref="computedID" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
> />
>     </resolver:AttributeDefinition>
>
> Would it be something like:
>
> In attribute-resolver:
>
> <resolver:AttributeDefinition id="persistentNameIdSourceUid"
> xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> sourceAttributeID="myChosenAttribute">
>     <resolver:Dependency ref="directory" />
>   </resolver:AttributeDefinition>
>
> In saml-nameid.properties:
>
> idp.persistentId.sourceAttribute = persistentNameIdSourceUid
> [...other computed ID lines...]
>
> In saml-nameid.xml:
>
> Use the shibboleth.ComputedPersistentIdGenerator bean - though I am
> having trouble finding an actual example of the syntax for this guy. (The
> only one I've messed with is the SAML2AttributeSourcedGenerator.) This
> would be my first stab at it, using the urn:oid for the eduPersonTargetedID:
>
> <bean parent="shibboleth.ComputedPersistentIdGenerator"
>   p:format:="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
>
> Even so, this doesn't tell me what I would put in the attribute resolver
> for this attribute.
>
> I really would rather not play Guess The Syntax. ;-)  So if anyone has an
> actual example of how they've done this... or if anyone could tell me if
> it's even possible? If it's not possible, then I'm afraid my users' saved
> Hathitrust searches (or whatever) are not going to be there because I'm
> going to have to go to using eppn.
>
> Thanks. Sorry this is so long.
> Karla B
>
>
>
>
> --
> Karla Borecky
> Systems Administrator
> ITS
> Smith College
> Northampton, MA 01063
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160309/1e09f678/attachment.html>