Allowed values for NameIDFormat

[Ian Bobbitt]

On 10/24/16 12:56 PM, Cantor, Scott wrote:
>> I'm working on setting up authentication with a vended product that
>> minimally supports SAML2 (Service Now). They only
>> look at the NameID, not any Attributes.
> 
> I did not believe that to still be true, but I am indeed using NameID with it for historical reasons so I can't prove it.
> 

The docs I've been able to find [1] say "The login script extracts the XML value from the //Subject/NameID element and
uses it to look up an existing user in the User table." This is for their latest version. It's possible the docs are
wrong, or I'm looking at the wrong place.

>> Is it better to use the urn:oasis:names:tc:SAML:1.1:nameid-
>> format:unspecified NameIDFormat
> 
> Nobody should use that format for any reason. It should never have been created.
> 

Noted.

>> and a Relying Party override
>> to force generating the NameID from ePPN, or can/should I setup a NameID
>> generator for urn:oid:1.3.6.1.4.1.5923.1.1.1.6
>> (ePPN's OID URN) and drive the selection from a NameIDFormat element in
>> the SP's metadata?
> 
> How you accomplish the format selection is a style/config-mgmt decision, use whichever of the two mechanisms you prefer to ensure you understand what it's doing and don't lose sight of it.
> 
> Using the attribute name as the format is an appropriate choice when possible.
> 

Adding this in saml-nameid.xml in the shibboleth.SAML2NameIDGenerators <list />:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
            p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }" />

And setting this in the SP's Metadata:

<NameIDFormat>urn:oid:1.3.6.1.4.1.5923.1.1.1.6</NameIDFormat>

And releasing the eduPersonPrincipalName attribute to the SP should do what I want?

> -- Scott
> 
> 


[1]
https://docs.servicenow.com/bundle/helsinki-servicenow-platform/page/integrate/saml/concept/c_LoginAuthnRequestProcessFlow.html

-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3639 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20161024/dd5f50b7/attachment.p7s>