IdPv3 - eduPersonTargetedID - How to define and release this *name ID*?

[Waldbieser, Carl]

I set up the relying party override with a "nameIDFormatPrecedence" of "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".  I authenticate to an SP, but in the logs I see the following:

  Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
  Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
  Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty

In `saml-nameid.properties` I set the "idp.persistentId.sourceAttribute" and "idp.persistentId.salt" properties.  I thought this was sufficient to enable the "Computed" name ID generator.  Is there some logging setting I can set to determine *why* the NameID could not be generated?

Thanks,
Carl

----- Original Message -----
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Thursday, March 17, 2016 12:23:02 PM
Subject: RE: IdPv3 - eduPersonTargetedID - How to define and release this attribute?

> But I am not sure where I go from there.  I am thinking that I need to configure
> *something* to make the Name ID available to an R&S supporting SP-- but I
> don't know what that *something* is.

NameID Format selection is discussed on the top level NameIDGeneration page, but to do this on the basis of R&S universally, what you would do is probably set up a RelyingPartyByTag override in relying-party.xml that references the R&S EntityAttribute and specify the nameIDFormatPrecedence property in that override with the constant for the "persistent" Format.

The RelyingPartyConfiguration topic has an example of doing an override for R&S explicitly, and the nameIDFormatPrecedence setting goes inside the SAML2.SSO profile config bean you enable in the override.

Ordinarily the NameID Format should be driven by metadata or the SP, but to cover a whole tagged class of applications, a tag-based override is the simplest way.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net