persitentID nameID for specific SPs, transient for default

[Boyd, Todd M.]

Nah -- the activationCondition property contains that bean element. The </bean> you're talking about is for the higher-level SAML2AttributeSourcedGenerator which encompasses the whole thing.


-Todd

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Craig Pluchinsky
Sent: Wednesday, December 13, 2017 9:28 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: persitentID nameID for specific SPs, transient for default

Check your saml-nameid.xml config again.  Shouldn't </property> be above </bean>?

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
     p:omitQualifiers="true"
     p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
     p:attributeSourceIds="#{ {'mail', 'othermail'} }">

     <property name="activationCondition">
         <bean parent="shibboleth.Conditions.RelyingPartyId" 
c:candidate="https://sp.example.com/shibboleth" />
     </property>
</bean>


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Wed, 13 Dec 2017, Jehan PROCACCIA wrote:

> 
> Hello
> 
> Some SP and vendors wants a particular nameID to authorize acces to 
> their services, ei eduPersonTargetedID as a persistentID
> 
> I want to be able to send this particular nameID only to specific SPs
> 
> but still take advantage of a default nameid-format:transient for the 
> other majority of SPs , so that I am not exposed to a global failure 
> if a the eduPersonTargeted storeID DB fails
> 
> I figured out that doc related to that purpose 
> https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGener
> ationConfiguration
> 
> 
> so I uncommented in saml-nameid.properties
> 
> 
> # For computed IDs, set a source attribute and a secret salt:
> idp.persistentId.sourceAttribute = mail 
> idp.persistentId.useUnfilteredAttributes = true # Do *NOT* share the 
> salt with other people, it's like divulging your private key.
> idp.persistentId.algorithm = SHA
> idp.persistentId.salt = secret
> 
> 
> and uncommented bold section below in saml-nameid.xml expecting to get 
> a Persitent nameID format for the targeted SP "https://services.renater.fr/shibboleth"
> 
> <!-- SAML 2 NameID Generation -->
>     <util:list id="shibboleth.SAML2NameIDGenerators">
> 
>         <ref bean="shibboleth.SAML2TransientGenerator" />
> 
>         <!-- Uncommenting this bean requires configuration in 
> saml-nameid.properties. -->
>         <ref bean="shibboleth.SAML2PersistentGenerator" />
> 
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'mail'} }" >
> 
>                 <property name="activationCondition">
>             <bean parent="shibboleth.Conditions.RelyingPartyId" 
> c:candidate="https://services.renater.fr/shibboleth" />
> 
>         </bean>
>     </property>
>     </util:list>
> 
> 
> Unfortunaltly is doesn't seem to work according to IDP's process log:
> 
> but regarding nameID there is a pb
> 2017-12-11 16:10:57,297 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects:
> Trying to generate NameID with Format 
> urn:oasis:names:tc:SAML:2.0:nameid-format:transient
> 2017-12-11 16:10:57,298 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects:
> Error while generating NameID
> org.opensaml.saml.common.SAMLException: Invalid 
> NameIdentifierGenerationService configuration
>         at 
> net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate
> (ProxySAML2NameIDGenerator.java:62)
> 2017-12-11 16:10:57,299 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects:
> Unable to generate a NameID, leaving empty
> 
> 
> 1st it tries to send a transient namedID , although I expected a 
> computed on the fly persitenID based on mail attribute regarding my 
> config  bean="shibboleth.SAML2PersistentGenerator above
> 
> 2nd it fails => Unable to generate a NameID, leaving empty
> 
> 
> although finally there seems to be a transient namedID though !?
> 
> 2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] 
> -20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_
> 411aa04d9cff0e56166ea4ac8e2725a4|https://services.renater.fr/shibb
> oleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3
> oleth|.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:
> oleth|H
> TTP-POST|_f6c77f00f87dfbee3b92b4581800aae4|procaccia|urn:oasis:names:t
> TTP-POST|c:SAML:2.0:ac:classes:PasswordProtectedTransport
> 
> |uid,mail,eduPersonPrincipalName||_4c7ace16b2aa2056cec31abf2591e650|
> 
> 
> Where did I done wrong ?
> 
> 
> regards .
> 
> 
> 
> 
>