persitentID nameID for specific SPs, transient for default

[Boyd, Todd M.]

We do this for a few specific SPs. Here’s our saml-nameid.xml config:

                <util:list id="shibboleth.SAML2NameIDGenerators">
                                <ref bean="shibboleth.SAML2TransientGenerator" />
                                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                                p:format="urn:oid:1.3.6.1.4.1.32548.1.1.2"
                                                p:attributeSourceIds="#{ {'campusPermanentId'} }" />
                </util:list>

And here’s our attribute-filter.xml config to release that attribute:

                <AttributeFilterPolicy id="releaseCollegeID">
                                <PolicyRequirementRule xsi:type="Requester" value="https://vendor.entity.id.here" />
                                <AttributeRule attributeID="campusPermanentId">
                                                <PermitValueRule xsi:type="ANY" />
                                </AttributeRule>
                </AttributeFilterPolicy>

And finally, their metadata is calling out for this particular NameID claim type:

<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                                <md:NameIDFormat>urn:oid:1.3.6.1.4.1.32548.1.1.2</md:NameIDFormat>
                                <!-- other stuff here -->
                </md:SPSSODescriptor>

If their metadata isn’t calling for it explicitly, I suppose that’s where you need a little more config customization to get you over the hurdle.


-Todd

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jehan PROCACCIA
Sent: Wednesday, December 13, 2017 9:06 AM
To: users at shibboleth.net
Subject: persitentID nameID for specific SPs, transient for default


Hello

Some SP and vendors wants a particular nameID to authorize acces to their services, ei eduPersonTargetedID as a persistentID

I want to be able to send this particular nameID only to specific SPs

but still take advantage of a default nameid-format:transient for the other majority of SPs , so that I am not exposed to a global failure if a the eduPersonTargeted storeID DB fails

I figured out that doc related to that purpose https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration



so I uncommented in saml-nameid.properties



# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute = mail
idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like divulging your private key.
idp.persistentId.algorithm = SHA
idp.persistentId.salt = secret



and uncommented bold section below in saml-nameid.xml expecting to get a Persitent nameID format for the targeted SP "https://services.renater.fr/shibboleth"<https://services.renater.fr/shibboleth>

<!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
        <ref bean="shibboleth.SAML2PersistentGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" >

                <property name="activationCondition">
            <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://services.renater.fr/shibboleth"<https://services.renater.fr/shibboleth> />

        </bean>
    </property>
    </util:list>



Unfortunaltly is doesn't seem to work according to IDP's process log:

but regarding nameID there is a pb
2017-12-11 16:10:57,297 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient
2017-12-11 16:10:57,298 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration
        at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2017-12-11 16:10:57,299 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty



1st it tries to send a transient namedID , although I expected a computed on the fly persitenID based on mail attribute regarding my config  bean="shibboleth.SAML2PersistentGenerator above

2nd it fails => Unable to generate a NameID, leaving empty



although finally there seems to be a transient namedID though !?

2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] - 20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411aa04d9cff0e56166ea4ac8e2725a4|https://services.renater.fr/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87dfbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<https://services.renater.fr/shibboleth%7Chttp:/shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps:/idp3.tem-tsp.eu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f6c77f00f87dfbee3b92b4581800aae4%7Cprocaccia%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport>

|uid,mail,eduPersonPrincipalName||_4c7ace16b2aa2056cec31abf2591e650|



Where did I done wrong ?



regards .




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171213/2750c8a4/attachment-0001.html>