persitentID nameID for specific SPs, transient for default

[Andrew Morgan]

On Sat, 16 Dec 2017, Jehan Procaccia wrote:

> /<?xml version="1.0" encoding="UTF-8"?>//
> //<saml2:Assertion ID="_857fd67215521bceb9255b8cdc330565"//
> //    IssueInstant="2017-12-16T15:55:54.201Z" Version="2.0" 
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">//
> //<saml2:Issuer>https://idp3.tem-tsp.eu/idp/shibboleth</saml2:Issuer>//
> //    <saml2:Subject>//
> ////*<saml2:NameID*//
> ////*Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"*//
> //NameQualifier="https://idpr3.tem-tsp.eu/idp/shibboleth" 
> SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">cypRgyH6qc0Iifq1UFZGlgCKDLA=</saml2:NameID>//
> //        <saml2:SubjectConfirmation 
> Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">//
> //            <saml2:SubjectConfirmationData Address="91.160.29.24"//
> //InResponseTo="_355cfc3984ad6ddfd324ad97166832e3ab4315eb67"//
> //                NotOnOrAfter="2017-12-16T16:00:54.257Z" 
> Recipient="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp"/>//
> //        </saml2:SubjectConfirmation>/

It looks like you were successful generating a persistent NameID and 
releasing it to the SP, based on the above <saml2:Subject> element.

> but , now regardless of whether it should be enought what that nameID format 
> and addind a attribute definition for that persistendID as an attribute 
> definition with eduPersonTargetID [ePTID]  to do it might be deprecated,
>
> as that SP requires it, I don't know how to generate ePTID from the above 
> computed persistenID nameID format I just finally end up generating .

The NameID generation is separate from the attribute resolution.  Now that 
you have the NameID working, you can generate the eduPersonTargetedID by 
modifying attribute-resolver.xml.  Here is my configuration:

     <!-- Computed targeted ID connector -->
     <DataConnector xsi:type="ComputedId"
                             id="computedID"
                             generatedAttributeID="computedID"
                             sourceAttributeID="<your-source-attribute>"
                             salt="%{idp.persistentId.salt}">
         <Dependency ref="myLDAP" />
     </DataConnector>

     <AttributeDefinition xsi:type="SAML2NameID" id="eduPersonTargetedID"
                                   nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID">
         <Dependency ref="computedID" />
         <AttributeEncoder xsi:type="SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
         <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
     </AttributeDefinition>

The ComputedID DataConnector 
(https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector) 
builds the hashed value from the source attribute, the same as the 
shibboleth.ComputedPersistentIdGenerator does.  The eduPersonTargetedID 
attribute definition encodes it as a SAML2XMLObject, which is what the SP 
is expecting.

Once you have the eduPersonTargetedID attribute generated, modify 
attribute-filter.xml to release it to the SP (the same way as any other 
attribute is released).

BTW, you may want to choose a different sourceAttribute than 
eduPersonPrincipalName.  You need a source attribute that is persistent 
(long-lived and never re-used for a different person/subject).  Maybe 
eduPersonPrincipalName meets those requirements for you, maybe not.  We 
used an internal IDM-generated identifier as our source attribute instead.

Good luck!

Thanks,
 	Andy