persistant nameid conflicting requirements

Youssef GHORBAL youssef.ghorbal at pasteur.fr
Tue Mar 29 14:55:12 EDT 2016


Hello,

	IdP 3.2.1 and persistant nameid generation conflicting requirement.
	I have a silly SP that needs a persistant nameid format but with the account uid in the value.
	Right now the IdP generates the persistant nameid according to the properties file (sha, with a salt etc)

	Can I configure an override for that particular SP that generates a nameid with a custom persistant value ?

	I tried to use the "Dealing with Conflicting Requirements” trick in the documentation :
	https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration

	adding this :

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            p:attributeSourceIds="#{ {'uid'} }">

            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://sillySP" />
            </property>
        </bean>

	But IdP is still sending the calculated persistent nameid.

	Thank you for your help !

Youssef Ghorbal
Institut Pasteur


More information about the users mailing list