persitentID nameID for specific SPs, transient for default
Jehan Procaccia
jehan.procaccia at tem-tsp.eu
Sat Dec 16 11:28:19 EST 2017
Le 15/12/2017 à 21:58, Cantor, Scott a écrit :
> Actually I will give you a concrete suggestion. Change the fail fast property on the NameID generation service in services.properties to true and restart.
>
> -- Scott
>
>
Good advice ! setting /idp.service.failFast = true/ in
/services.properties/ showed me a fail on IDP startup with :
Caused by:
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Service 'shibboleth.NameIdentifierGenerationService': could not perform
initial load
ry.BeanCreationException: Error creating bean with name
'shibboleth.ComputedPersistentIdGenerator' defined in file
[/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]: Invocation of
init method failed; nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
*Salt must be at least 16 bytes in size*
Indeed my initial salt of "1234" was not 16 byte in size ! so I made it
longer , and now my IDP does start without that error , good step forward .
I also uncomment in /saml-nameid.properties /
# To use a database, use shibboleth.StoredPersistentIdGenerator
*idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator**
*
but you sais that is was a default, so no need to uncomment it
apparently , I didn't uncommented in the 1rst place beacause of the
comment just above regarding use a a DB that I miss understood ...
Now back to my initial need to acces that SP
https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp
with those metadata requesting an eduPersonTargetedID and a persistent nameID-format
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:*nameid-format:persistent<*/md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:RequestedAttribute Name="urn:oid:*1.3.6.1.4.1.5923.1.1.1.10*" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
and clearly asking for ePTID (eduPersonTargetedID)
From
https://met.idem.garr.it/met/entity//https%253A%252F%252Fmonitor.eduroam.org%252Fsp%252Fmodule.php%252Fsaml%252Fsp%252Fmetadata.php%252Fdefault-sp/?federation=edugate-federation//
/
//
/Required attributes: //
// urn:oid:1.3.6.1.4.1.5923.1.1.1.10 (eduPersonTargetedID)/
from my IDP logs I now do generate a *nameid-format:persistent*
/2017-12-16 16:55:54,249 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- //*Metadata specifies the following formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent*//,
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]//
/
/2017-12-16 16:55:54,250 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.PersistentSAML2NameIDGenerator:215]
- //*Generating persistent NameID from Scoped String-valued attribute
eduPersonPrincipalName*//
/
/2017-12-16 16:55:54,251 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118]
- //*Successfully generated identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent*//
/
/<?xml version="1.0" encoding="UTF-8"?>//
//<saml2:Assertion ID="_857fd67215521bceb9255b8cdc330565"//
// IssueInstant="2017-12-16T15:55:54.201Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">//
//<saml2:Issuer>https://idp3.tem-tsp.eu/idp/shibboleth</saml2:Issuer>//
// <saml2:Subject>//
////*<saml2:NameID*//
////*Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"*//
//NameQualifier="https://idpr3.tem-tsp.eu/idp/shibboleth"
SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">cypRgyH6qc0Iifq1UFZGlgCKDLA=</saml2:NameID>//
// <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">//
// <saml2:SubjectConfirmationData Address="91.160.29.24"//
//InResponseTo="_355cfc3984ad6ddfd324ad97166832e3ab4315eb67"//
// NotOnOrAfter="2017-12-16T16:00:54.257Z"
Recipient="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp"/>//
// </saml2:SubjectConfirmation>/
but , now regardless of whether it should be enought what that nameID
format and addind a attribute definition for that persistendID as an
attribute definition with eduPersonTargetID [ePTID] to do it might be
deprecated,
as that SP requires it, I don't know how to generate ePTID from the
above computed persistenID nameID format I just finally end up generating .
it clearly relates to previous same discussion:
http://shibboleth.net/pipermail/users/2016-March/028126.html
http://shibboleth.net/pipermail/users/2016-March/028138.html
I defined in attribute-resolver an ePTID this way (maybe wrong ?) :
/<resolver:AttributeDefinition id="eduPersonTargetedID"//
// xsi:type="ad:Simple"
sourceAttributeID="eduPersonPrincipalName">//
// <resolver:Dependency ref="myLDAP" />//
// <resolver:AttributeEncoder xsi:type="enc:SAML1String"//
//name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />//
// <resolver:AttributeEncoder xsi:type="enc:SAML2String"//
//name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" />//
// </resolver:AttributeDefinition>/
and it is well created and sent by my IDP :
2017-12-16 17:05:49,817 - DEBUG
[net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:167] -
Attribute filtering engine 'ShibbolethAttributeFilter': *1 values for
attribute 'eduPersonTargetedID' remained after filtering*
2017-12-16 17:05:53,949 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
Encoding value procaccia at tem-tsp.eu of attribute eduPersonTargetedID
2017-12-16 17:05:53,949 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
- *Completed encoding 1 values for attribute eduPersonTargetedID*
*<saml2:Attribute FriendlyName="eduPersonTargetedID"**
** Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">*
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">procaccia at tem-tsp.eu</saml2:AttributeValue>
</saml2:Attribute>
but should'nt
*NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" *be
persistent instead of uri ?*
*
still acces to the SP loops on the login form without success, so I
guess I'am seding it a wrong ePTID, either as a nameID format (i don't
thing so) , but mostly a an bad attribute definition, probably not
correclty formated and not linked to the persistenID ?
Sorry for that long discussion, but I suspect that I am not far from
succeed, and learn a lot on the subject that might also help others .
thanks .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171216/44327795/attachment.html>
More information about the users
mailing list