SPs with different NameIds

[Andrew Morgan]

On Sat, 30 Apr 2016, Senthil Ramiah wrote:

> Hello,
> We are running Idp version 3.1.1. We need to support two SPs with different
> nameId requirements (and different formats). Here is what we have for the
> following config files. We need the *systemtwonameid* to come through in
> the <subject> section only for the second SP instead of the mail attribute.
> Looks like we are missing something and are unable to get it to work. Any
> pointers on how to get this to work will be appreciated.
>
>
> *saml-nameid.xml...    <util:list id="shibboleth.SAML2NameIDGenerators">
>        <ref bean="shibboleth.SAML2TransientGenerator" />
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> p:attributeSourceIds="#{ {'mail'} }" />        <bean
> parent="shibboleth.SAML2AttributeSourcedGenerator"
> p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> p:attributeSourceIds="#{ {'systemtwonameid'} }" >
>        <property name="activationCondition">                <bean
> parent="shibboleth.Conditions.RelyingPartyId"
> c:candidate="http://systemtwo.xxx.com/shibboleth
> <http://systemtwo.xxx.com/shibboleth>" />            </property>
> </bean -->                    </util:list>...*
>
>
> *attribute-filter.xml<afp:AttributeFilterPolicy
> id="abcid"><afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString"
> value="http://abc.xyz.com/shibboleth <http://abc.xyz.com/shibboleth>"
> /><afp:AttributeRule attributeID="mail">    <afp:PermitValueRule
> xsi:type="basic:ANY"
> /></afp:AttributeRule></afp:AttributeFilterPolicy><afp:AttributeFilterPolicy
> id="systemtwo">  <afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString"
> value="http://systemtwo.xxx.com/shibboleth
> <http://systemtwo.xxx.com/shibboleth>" />    <afp:AttributeRule
> attributeID="systemtwonameid">        <afp:PermitValueRule
> xsi:type="basic:ANY" />
> </afp:AttributeRule></afp:AttributeFilterPolicy>...*

What NameID is being released for systemtwo now?

What NameID Format is systemtwo requesting (either via the SAML 
authentication request or in systemtwo's metadata)?

The IDP tries to satisfy the SP's requirements.  First, it looks for a 
NameID Format in the SAML authn request.  If no format is specified, it 
looks in the SP's metadata for a NameID Format.  Once the IDP knows what 
NameID Format is needed, it sees if one of the generated NameIDs matches 
that format.

 	Andy