persitentID nameID for specific SPs, transient for default

Fri Dec 15 15:41:16 EST 2017

Le 15/12/2017 à 00:37, Cantor, Scott a écrit :
> On 12/14/17, 6:05 PM, "users on behalf of Jehan Procaccia" <users-bounces at shibboleth.net on behalf of jehan.procaccia at tem-tsp.eu> wrote:
>
>> which one ? probably
>> https://wiki.shibboleth.net/confluence/display/IDP30/PersistentNameIDGenerationConfiguration
>> can you confirm ?
> That is the only documentation there is, yes.
>
OK, then I followed that doc, configured my IDP keeping the default 
Transient nameID and added shibboleth.SAML2PersistentGenerator in 
saml-nameid.xml

<util:list id="shibboleth.SAML2NameIDGenerators">
         <ref bean="shibboleth.SAML2TransientGenerator" />
         
*   <ref bean="shibboleth.SAML2PersistentGenerator" />*
  </util:list>

and in saml-nameid.properties I uncommented as recommended for 
computedID without DB

# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute = eduPersonPrincipalName
idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like divulging your 
private key.
idp.persistentId.algorithm = SHA
idp.persistentId.salt = secret

but still accessing

https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp

with those metadata requesting an eduPersonTargetedID and a persistent nameID-format

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:*nameid-format:persistent<*/md:NameIDFormat>
       <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:RequestedAttribute Name="urn:oid:*1.3.6.1.4.1.5923.1.1.1.10*" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>

doesn't work .

How can I check (local to IDP) that I do generate a persitendID ?

as suggested previously by Peter, aacli does show me attributes , but it 
doesn't show me nameIDs , is there another tool ?

[root at idpr3 shibboleth-idp]# ./bin/*aacli.sh 
*--requester=https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp 
--configDir=conf/ --principal=procaccia *--saml2*

**
/<?xml version="1.0" encoding="UTF-8"?>//
//<saml2:Assertion ID="_54ee1b2ba156f6c80ec2154ca23c7528"//
//    IssueInstant="2017-12-15T19:57:45.542Z" Version="2.0" 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">//
//<saml2:Issuer>https://idp3.tem-tsp.eu/idp/shibboleth</saml2:Issuer>//
//    <saml2:AttributeStatement>//
//        <saml2:Attribute FriendlyName="uid"//
//            Name="urn:oid:0.9.2342.19200300.100.1.1" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">//
//            <saml2:AttributeValue//
//xmlns:xsd="http://www.w3.org/2001/XMLSchema"//
//xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">procaccia</saml2:AttributeValue>//
//        </saml2:Attribute>//
//        <saml2:Attribute FriendlyName="mail"//
//            Name="urn:oid:0.9.2342.19200300.100.1.3" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">//
//            <saml2:AttributeValue//
//xmlns:xsd="http://www.w3.org/2001/XMLSchema"//
//xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">jehan.procaccia at tem-tsp.eu</saml2:AttributeValue>//
//        </saml2:Attribute>//
//        <saml2:Attribute FriendlyName="eduPersonPrincipalName"//
//            Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">//
//            <saml2:AttributeValue//
//xmlns:xsd="http://www.w3.org/2001/XMLSchema"//
//xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xsd:string">procaccia at tem-tsp.eu</saml2:AttributeValue>//
//        </saml2:Attribute>//
//    </saml2:AttributeStatement>//
//</saml2:Assertion>/

I keep using DEBUG in my IDP , I copy below ligns containing NameID 
keyword :

/2017-12-15 20:59:33,646 - DEBUG 
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile 
Action AddNameIDToSubjects: Attempting to add NameID to outgoing 
Assertion Subjects//
//2017-12-15 20:59:33,646 - DEBUG 
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:139] 
- No object to operate on, returning true//
//2017-12-15 20:59:33,647 - DEBUG 
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] 
- Metadata specifies the following formats: 
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent, 
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]//
//2017-12-15 20:59:33,647 - DEBUG 
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] 
- Configuration specifies the following formats: []//
//2017-12-15 20:59:33,647 - DEBUG 
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:113] 
- Configuration did not specify any formats, relying on metadata alone//
//2017-12-15 20:59:33,647 - DEBUG 
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile 
Action AddNameIDToSubjects:*Candidate NameID formats: 
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent, 
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]*//
//2017-12-15 20:59:33,647 - DEBUG 
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile 
Action AddNameIDToSubjects: *Trying to generate NameID with Format 
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent*//
//2017-12-15 20:59:33,648 - *ERROR 
*[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - 
Profile Action AddNameIDToSubjects: *Error while generating NameID*//
//org.opensaml.saml.common.SAMLException: Invalid 
NameIdentifierGenerationService configuration//
//        at 
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)//
//
/

Although PersistendID seems to be generated here at lign "/2017-12-15 
20:59:33,647"/, if fails with an error.

what is wrong in my settings ?

If I finally succeed in creating an persistent nameID within 
saml-nameid.xml and in .properties without error, do I need later on to 
construct the eduPersonTargetedID and how to "map" it to the Persistent 
NameID juste created for the session ?

for storeID I found sample at 
https://services.renater.fr/federation/docs/installation/idp3/chap11#creer_un_attribut_persistentidedupersontargetedid

<!-- Targeted ID/Persistent ID -->
<resolver:AttributeDefinition id="eduPersonTargetedID" 
xsi:type="ad:SAML2NameID" sourceAttributeID="persistentID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
<resolver:Dependency ref="myStoredId" />
<resolver:DisplayName xml:lang="en">Targeted ID</resolver:DisplayName>
<resolver:DisplayDescription xml:lang="en">Targeted ID: A unique 
identifier for a person, different for each service 
provider.</resolver:DisplayDescription>
<resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" 
friendlyName="eduPersonTargetedID" />
</resolver:AttributeDefinition>

<resolver:DataConnector id="myStoredId"
xsi:type="dc:StoredId"
generatedAttributeID="persistentID"
sourceAttributeID="eduPersonPrincipalName"
salt="%{idp.persistentId.salt}"
queryTimeout="0">
<resolver:Dependency ref="%{idp.persistentId.sourceAttribute}" />
<dc:BeanManagedConnection>shibboleth.MysqlDataSource</dc:BeanManagedConnection>
</resolver:DataConnector>

but here the

<resolver:Dependency ref="myStoredId" />

should be replace with what ? some kind of "myComputedId" !?

thanks.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171215/f30c0616/attachment-0001.html>