nameid-format:persistent and issues

[Peter Schober]

* Lalith Jayaweera <ljayaweera at gmail.com> [2017-04-27 10:17]:
> urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
> 
> in idp 2.4.x for Azure(Mcrosoft) integration the value of nameID
> with above format was passed with the raw value of uid without any
> salt/encoding applied to it.

That's not legal according to the SAML specification, cf. 8.3.7 on
page 86 of SAML Core:
https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf

> however I can see in idp 3.2.x we can do salt etc for the persistent
> NameID

That always was possible.

> how to pass the uid value without applying any SALT etc....so that row uid
> will be passed to the other end with
> format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent similar to idp
> 2.4.x
> 
> If I have to change saml-nameid.properties please advice

I guess could disable (comment out) the
bean="shibboleth.SAML2PersistentGenerator" in conf/saml-nameid.xml and
instead add an attribute-based NameID there, e.g.

  <!-- This violates the SAML specification! -->
  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
        p:attributeSourceIds="#{{'uid'} }" />

If everything there remains commented out you only need to release the
uid attribute to the SP in question (to trigger release of the
uid-based NameID).

-peter