persistant nameid conflicting requirements

[Walter Forbes Hoehn (wassa)]

You also need to add an activation condition to the “standard” persistent ID generator that switches it off for that relying party. As Scott already said, it’s way better to not do this if you have any other option.

-WFH

For instance:

        <bean parent="shibboleth.SAML2PersistentGenerator">
            <property name="activationCondition">
                    <bean parent="shibboleth.Conditions.NOT">
                        <constructor-arg>
                         <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'urn:federation:MicrosoftOnline'}}" />
                        </constructor-arg>
                    </bean>
            </property>
        </bean>


> On Mar 29, 2016, at 1:55 PM, Youssef GHORBAL <youssef.ghorbal at pasteur.fr> wrote:
> 
> Hello,
> 
> 	IdP 3.2.1 and persistant nameid generation conflicting requirement.
> 	I have a silly SP that needs a persistant nameid format but with the account uid in the value.
> 	Right now the IdP generates the persistant nameid according to the properties file (sha, with a salt etc)
> 
> 	Can I configure an override for that particular SP that generates a nameid with a custom persistant value ?
> 
> 	I tried to use the "Dealing with Conflicting Requirements” trick in the documentation :
> 	https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration
> 
> 	adding this :
> 
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>            p:attributeSourceIds="#{ {'uid'} }">
> 
>            <property name="activationCondition">
>                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://sillySP" />
>            </property>
>        </bean>
> 
> 	But IdP is still sending the calculated persistent nameid.
> 
> 	Thank you for your help !
> 
> Youssef Ghorbal
> Institut Pasteur
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net