NameID Generation to SP

[Cantor, Scott]

On 3/24/16, 7:56 PM, "users on behalf of Jay Mey" <users-bounces at shibboleth.net on behalf of jmey at vmware.com> wrote:



>I am new to SAML and Shibboleth in general and I am trying to learn how it works while trying to demo its’ flexibility as an IdP. I have an SP which accepts the following NameID Formats:

That's very doubtful. Applications generally either want something very specific, or don't care at all and would prefer there was nothing but "an ID" with no qualification on it at all. There is no chance whatsoever that all four of those totally disparate values could possibly make sense in a single system at the same time unless that system was passing data through to wildly different services with totally different requirements.

><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

Saying you support three specific, totally unrelated and differently natured types of IDs and you also support "a type I can't explain or specify" is just ridiculous.

The SP doesn't know what it wants or it doesn't care, or you're relying on meaningless metadata that was created with no regard for accuracy.

>I currently have Shibboleth IdP connecting to Active Directory and returning the correct attributes I need (mail and memberOf). The problem is having the mail attribute encode to the above NameID Formats.

There is no attribute to encode into a transient ID. A persistent ID only uses an attribute as a seed, and you would never seed it with an email address.

>Currently, I have enabled persistent NameID Generator and it seems to be doing the encoding properly as seen below in the idp-process.log. The end result of the mail attribute is a string like "9UoJLXa4TmaVDLUSk+7nh+9xUa4=“
> which is what is passed on to my SP as the username and email. The SP cannot read it in this format. Is this the correct result that should be expected?

If you want to understand transient or persistent NameIDs, read the SAML specification, they are fully explained.

The emailAddress Format should be self explanatory.

-- Scott