unspecified NameID in subject(V2) how to recreate in V3
Shweta Kautia
skautia at northcarolina.edu
Fri Oct 21 14:37:08 EDT 2016
Hello,
I’ve read through the wiki, and posts on this list, and tried a bunch of things but have not made a breakthrough. If someone could please describe what I need to do, to re-create what we had for V2 NameID/Subject that would be Super helpful . This is specific to a vendor SP, that is breaking with a “Key Validation error” their side, with no other details. We are in the process of getting more info from them. However, till then, I need to figure out how to re-create the NameID as in V2.
Many Many Thanks!
Referenced -https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith”Unspecified"<https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22>
Specific file changes that need to be made:
* saml-nameid.xml — Any other bean needs to be added here?
*
* <!-- SAML 2 NameID Generation -->
* <util:list id="shibboleth.SAML2NameIDGenerators">
*
* <ref bean="shibboleth.SAML2TransientGenerator" />
*
* <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
* <!--
* <ref bean="shibboleth.SAML2PersistentGenerator" />
* -->
*
* <!--
* <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
* p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
* p:attributeSourceIds="#{ {'mail'} }" />
* -->
*
* </util:list>
*
*
* <!-- SAML 1 NameIdentifier Generation -->
* <util:list id="shibboleth.SAML1NameIdentifierGenerators">
*
* <ref bean="shibboleth.SAML1TransientGenerator" />
*
* <!--
* <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
* p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
* p:attributeSourceIds="#{ {'mail'} }" />
* -->
*
*
* </util:list>
*
*
* saml-nameid.properties — Do I uncomment these lines?
* # Comment out to disable legacy NameID generation via Attribute Resolver
* #idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
* #idp.nameid.saml1.legacyGenerator = shibboleth.LegacySAML1NameIdentifierGenerator
* relying-party.xml — Added the following bean in the “Overrides” section.
*
* <!-- Container for any overrides you want to add. -->
* <util:list id="shibboleth.RelyingPartyOverrides">
*
* <!-- V3 Vendor NameID format needs to be unspecified -->
* <bean parent="RelyingPartyByName" c:relyingPartyIds="https://vendoraddress.com">
* <property name="profileConfigurations">
* <list>
* <!-- Your refs or beans here. -->
* <bean parent="Shibboleth.SSO" />
* <ref bean="SAML1.AttributeQuery" />
* <ref bean="SAML1.ArtifactResolution" />
* <bean parent="SAML2.SSO" p:encryptNameIDs="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
* <bean parent="SAML2.AttributeQuery" p:encryptAssertions="false" p:encryptNameIDs="false" />
* <ref bean="SAML2.ArtifactResolution" />
* </list>
* </property>
* </bean>
* </util:list>
*
* attribute-resolver.xml — These V2 name encoders are NOT defined in V3 file.. Does something still need to go for V3?
*
*
* <!— V2 entry NOT included in V3 —>
* <RelyingParty id="https://vendoraddress.com"
* provider="https://campus.edu/idp/shibboleth"
* defaultSigningCredentialRef="IdPCredential">
* <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
* </RelyingParty>
*
*
*
*
* <!— V2 Name Identifier related attributes NOT included in V3 -->
* <resolver:AttributeDefinition id="transientId" xsi:type="TransientId" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
* <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
* xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
*
* <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
* xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
*
* <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
* nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
*
* <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
* nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
* </resolver:AttributeDefinition>
* idp.properties
* set with idp.encryption.optional = true
<—————— V2 output ——————>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
NameQualifier="https://campus.edu/idp/shibboleth"
>_2d09e366ab65d5708809090e123d</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address=“IP Address"
InResponseTo="_729ebc6d-8c67-491d-803b-741e63bfd686"
NotOnOrAfter="2016-10-18T14:59:46.721Z"
Recipient="https://vendoraddress.com/saml/authenticate"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<—————— V3 output ——————>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://campus.edu/idp/shibboleth”
SPNameQualifier="https://vendoraddress.com"
>AAdzZWNyZXQxvYMRAfUbww3NTdQF0A9ZuZA9L9PJltQU/izc7XRfNCozmkQEbfjs8aAH4+WpTGdkiNjlYTmi3Y38BLf9t0Dbqph2CLP0NEASYcKoUON+FV/RcIT/I4VAfQwqm0p7fvmksELns1g=</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="107.15.102.145"
InResponseTo="_8e867562-db15-4c53-8e1c-7354b32bdf6f"
NotOnOrAfter="2016-10-18T15:02:43.799Z"
Recipient="https://vendoraddress.com/saml/authenticate"<https://vendoraddress.com/saml/authenticate>
</saml2:SubjectConfirmation>
</saml2:Subject>
Thanks,
Shweta
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161021/aa2cca6c/attachment-0001.html>
More information about the users
mailing list