persitentID nameID for specific SPs, transient for default

[Jehan PROCACCIA]

Hello 

Some SP and vendors wants a particular nameID to authorize acces to their services, ei eduPersonTargetedID as a persistentID 


I want to be able to send this particular nameID only to specific SPs 


but still take advantage of a default nameid-format: transient for the other majority of SPs , so that I am not exposed to a global failure if a the eduPersonTargeted storeID DB fails 


I figured out that doc related to that purpose [ https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration | https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration ] 





so I uncommented in saml-nameid.properties 





# For computed IDs, set a source attribute and a secret salt: 
idp.persistentId.sourceAttribute = mail 
idp.persistentId.useUnfilteredAttributes = true 
# Do *NOT* share the salt with other people, it's like divulging your private key. 
idp.persistentId.algorithm = SHA 
idp.persistentId.salt = secret 





and uncommented bold section below in saml-nameid.xml expecting to get a Persitent nameID format for the targeted SP [ https://services.renater.fr/shibboleth | "https://services.renater.fr/shibboleth" ] 


<!-- SAML 2 NameID Generation --> 
<util:list id="shibboleth.SAML2NameIDGenerators"> 

<ref bean="shibboleth.SAML2TransientGenerator" /> 

<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> 
<ref bean="shibboleth.SAML2PersistentGenerator" /> 

<bean parent="shibboleth.SAML2AttributeSourcedGenerator" 
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" 
p:attributeSourceIds="#{ {'mail'} }" > 

<property name="activationCondition"> 
<bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate= [ https://services.renater.fr/shibboleth | "https://services.renater.fr/shibboleth" ] /> 

</bean> 
</property> 
</util:list> 





Unfortunaltly is doesn't seem to work according to IDP's process log: 


but regarding nameID there is a pb 
2017-12-11 16:10:57,297 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient 
2017-12-11 16:10:57,298 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID 
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration 
at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62) 
2017-12-11 16:10:57,299 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty 





1st it tries to send a transient namedID , although I expected a computed on the fly persitenID based on mail attribute regarding my config bean="shibboleth.SAML2PersistentGenerator above 


2nd it fails => Unable to generate a NameID, leaving empty 




although finally there seems to be a transient namedID though !? 


2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] - 20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411aa04d9cff0e56166ea4ac8e2725a4| [ https://services.renater.fr/shibboleth%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp3.tem-tsp.eu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f6c77f00f87dfbee3b92b4581800aae4%7Cprocaccia%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport | https://services.renater.fr/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87dfbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport ] 


|uid,mail,eduPersonPrincipalName|| _4c7ace16b2aa2056cec31abf2591e650 | 





Where did I done wrong ? 





regards . 






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171213/7c7035f1/attachment-0001.html>