nameid-format:persistent and issues

[Lalith Jayaweera]

Thanks

I commented the below (as follows) in saml-nameid.xml
 <!-- <ref bean="shibboleth.SAML2PersistentGenerator" /> -->

and added an section like below and things worked....

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
 p:omitQualifiers="true"
 p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
 p:attributeSourceIds="#{ {'uid'} }">
  <property name="activationCondition">
<bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="urn:federation:XXX" />
    </property>
</bean>


however it is not the best use of the format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent   ?

also it is discouraged to comment SAML2PersistentGenerator?

Also believe while commenting SAML2PersistentGenerator  not only for this
SP, it impact all the SPs with respect to this persistent NameID

Due to this, and also because I have defined the salt values and db details
in saml-nameid.xml (before commenting AML2PersistentGenerator), is it
possible to treat only this SP with SAML2AttributeSourcedGenerator for
format:persistent?

and leave the previous SAML2PersistentGenerator?

basically to override only for this SP and keep the original as is.

Let me know

Thanks



On Thu, Apr 27, 2017 at 6:28 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Lalith Jayaweera <ljayaweera at gmail.com> [2017-04-27 10:17]:
> > urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
> >
> > in idp 2.4.x for Azure(Mcrosoft) integration the value of nameID
> > with above format was passed with the raw value of uid without any
> > salt/encoding applied to it.
>
> That's not legal according to the SAML specification, cf. 8.3.7 on
> page 86 of SAML Core:
> https://www.oasis-open.org/committees/download.php/56776/
> sstc-saml-core-errata-2.0-wd-07.pdf
>
> > however I can see in idp 3.2.x we can do salt etc for the persistent
> > NameID
>
> That always was possible.
>
> > how to pass the uid value without applying any SALT etc....so that row
> uid
> > will be passed to the other end with
> > format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent similar to
> idp
> > 2.4.x
> >
> > If I have to change saml-nameid.properties please advice
>
> I guess could disable (comment out) the
> bean="shibboleth.SAML2PersistentGenerator" in conf/saml-nameid.xml and
> instead add an attribute-based NameID there, e.g.
>
>   <!-- This violates the SAML specification! -->
>   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>         p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>         p:attributeSourceIds="#{{'uid'} }" />
>
> If everything there remains commented out you only need to release the
> uid attribute to the SP in question (to trigger release of the
> uid-based NameID).
>
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170428/ed08b1a8/attachment.html>