persitentID nameID for specific SPs, transient for default

[Jehan PROCACCIA]

indeed in the edugain federation metadata, the SP does ask for a NameIDFormat to be persitent (and (or ?)) transient, here are the relevant metadata :

md:EntityDescriptor entityID="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">
    <md:Extensions>
      <mdattr:EntityAttributes>
        <saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
      <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

<md:RequestedAttribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>

my problem is that I need to generate an  eduPersonTargetedID for some SPs and I don't want to have a storeID in a DB used for each and every connexions, and don't dare to manage a DB for those rare usages
So I want to generate that  eduPersonTargetedID as a computedID on the fly and use it only for a "whitelist" of specific SPs 
is the https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration "Exemple of generator for specific SP": 
 <property name="activationCondition">
        <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://sp.example.com/shibboleth" />
    </property>
is the right way to achieve that ? 
let me know if I am following the correct path and docs ?  

I want to list both "https://services.renater.fr/shibboleth" and "https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp" in the candidate activationCondition , but cannot find the correct syntax ?

here is my current config in saml-nameid.xml

<!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
        <ref bean="shibboleth.SAML2PersistentGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" >

                <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://services.renater.fr/shibboleth" />
                </property>
        </bean>

    </util:list>

and in saml-nameid.properties

# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute = mail
idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like div ?ulging your private key.
idp.persistentId.algorithm = SHA
idp.persistentId.salt = secret

what could be wrong in that config ?

Thanks .

----- Mail original -----
De: "Cantor, Scott" <cantor.2 at osu.edu>
À: "users" <users at shibboleth.net>
Envoyé: Mercredi 13 Décembre 2017 17:54:59
Objet: Re: persitentID nameID for specific SPs, transient for default

On 12/13/17, 11:41 AM, "users on behalf of Jehan PROCACCIA" <users-bounces at shibboleth.net on behalf of jehan.procaccia at tem-tsp.eu> wrote:


> 2017-12-13 17:22:11,280 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action
> AddNameIDToSubjects: Error while generating NameID
> org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration

The error is not here, it's long past in the log. The configuration is broken and simply ignored.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net