Get SP's URL from the attribute-Resolver.xml or atribute-filter.xml file

[Glaidson Verzeletti]

Peter, thank you so much for your help.

Your tips were very helpful and I think they will help me to solve the
problem I have. I will try this solution and let you know if they results
come up successfully. It was very nice of you to take some time to help me,
I really appreciate that. If there is anything I can do to help you
somehow, please let me know.

My research project is in Brazil and it is related to Mobile ID. When I
finish this pratical part and publish the results, I can send you a copy if
you want.

Best regards.
Glaidson Verzeletti

On Tue, Oct 4, 2016 at 12:51 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Glaidson Verzeletti <verzeletti at gmail.com> [2016-10-04 17:37]:
> > I need to merge the URL of the SP (relay party) that is requesting
> > authentication to the IdP with the user UID. From these two pieces of
> > information, I will generate a hashMD5 that will serve as "username".
> >
> > I deliver a 'username' unique for each SP that the user accesses.
> >
> > This demand is part of a research project.
>
> I'd strongly recommend not inventing new identifiers of that kind,
> when existing ones are defined in the SAML standard that should
> satisfy the same criteria.
>
> Cf. 8.3.7 in SAML Core:
> https://www.oasis-open.org/committees/download.php/56776/
> sstc-saml-core-errata-2.0-wd-07.pdf
>
> The way the Shibboleth IDP implements this:
> https://wiki.shibboleth.net/confluence/display/IDP30/
> PersistentNameIDGenerationConfiguration
> this will produce an identifier that encodes an identifier for
> subject, the SP's entityID and the IDP's entityID into a salted hash.
> (Additionally that hash is accompanied by the recipient SP's and the
> asserting IDP's entiyID in separate XML attributes. SP's are free to
> use or ignore those additional data elements.)
>
> If the research project insists on re-inventing the wheel (and
> non-interoperably) there may be people who can help them get a bit of
> clue. In that case feel free to provide specifics about the research
> project (incl country/region of operation), possibly off-list.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/563bd045/attachment.html>