persitentID nameID for specific SPs, transient for default

[jehan procaccia]

Le 16/12/2017 à 18:40, Andrew Morgan a écrit :

> The NameID generation is separate from the attribute resolution.  Now 
> that you have the NameID working, you can generate the 
> eduPersonTargetedID by modifying attribute-resolver.xml.  Here is my 
> configuration:
>
>     <!-- Computed targeted ID connector -->
>     <DataConnector xsi:type="ComputedId"
>                             id="computedID"
>                             generatedAttributeID="computedID"
> sourceAttributeID="<your-source-attribute>"
>                             salt="%{idp.persistentId.salt}">
>         <Dependency ref="myLDAP" />
>     </DataConnector>
>
>     <AttributeDefinition xsi:type="SAML2NameID" id="eduPersonTargetedID"
> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
> sourceAttributeID="computedID">
>         <Dependency ref="computedID" />
>         <AttributeEncoder xsi:type="SAML1XMLObject" 
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
>         <AttributeEncoder xsi:type="SAML2XMLObject" 
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" 
> friendlyName="eduPersonTargetedID" />
>     </AttributeDefinition>
>
thanks a lot Andrew  for the example, it is what I was looking for, 
unfortunatly with this example my IDP fails on apparently a syntax pb :

/2017-12-18 10:27:23,825 - ERROR 
[org.springframework.web.context.ContextLoader:353] - Context 
initialization failed//
//org.springframework.beans.factory.BeanCreationException: Error 
creating bean with name 'shibboleth.AttributeResolverService' defined in 
file [/opt/shibboleth-idp/system/conf/services-system.xml]: Invocation 
of init method failed; nested exception is 
net.shibboleth.utilities.java.support.component.ComponentInitializationException: 
Service 'shibboleth.AttributeResolverService': could not perform initial 
load//
//        at 
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1578)//
//Caused by: 
net.shibboleth.utilities.java.support.component.ComponentInitializationException: 
Service 'shibboleth.AttributeResolverService': could not perform initial 
load//
//        at 
net.shibboleth.utilities.java.support.service.AbstractReloadableService.doInitialize(AbstractReloadableService.java:179)//
//Caused by: 
net.shibboleth.utilities.java.support.service.ServiceException: 
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: 
Line 340 in XML document from file 
[/opt/shibboleth-idp/conf/attribute-resolver-ldap.xml] is invalid; 
nested exception is org.xml.sax.SAXParseException; lineNumber: 340; 
columnNumber: 61; cvc-elt.4.2:*Cannot resolve 'ComputedId' to a type 
definition for element 'resolver:DataConnector'.*//
//        at 
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)//
//Caused by: 
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: 
*Line 340 in XML document from file 
[/opt/shibboleth-idp/conf/attribute-resolver-ldap.xml] is invalid; 
nested exception is org.xml.sax.SAXParseException; lineNumber: 340; 
columnNumber: 61; cvc-elt.4.2: Cannot resolve 'ComputedId' to a type 
definition for element 'resolver:DataConnector'.*//
//        at 
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)//
//Caused by: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve 
'ComputedId' to a type definition for element 'resolver:DataConnector'.//
//        at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)//
/
perhaps the warning  mention on 
https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector 
regarding different xml schema whether we use 3.3 or lower , mine 3.2 !?

suffixes as*dc* or *ad* needs to be added for me in v 3.2 ?
as in
<DataConnector xsi:type="*dc:*ComputedId" ?
or
<resolver:AttributeDefinition id="eduPersonTargetedID" 
xsi:type="*ad:*SAML2NameID"

here's what I have set :

     <resolver:DataConnector xsi:type="ComputedId"
                             id="computedID"
                             generatedAttributeID="computedID"
sourceAttributeID="eduPersonPrincipalName"
                             salt="%{idp.persistentId.salt}">
         <resolver:Dependency ref="myLDAP" />
     </resolver:DataConnector>


     <resolver:AttributeDefinition xsi:type="SAML2NameID" 
id="eduPersonTargetedID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
sourceAttributeID="computedID">
         <resolver:Dependency ref="computedID" />
         <resolver:AttributeEncoder xsi:type="SAML1XMLObject" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
         <resolver:AttributeEncoder xsi:type="SAML2XMLObject" 
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" 
friendlyName="eduPersonTargetedID" />
     </resolver:AttributeDefinition>

is there something wrong in my syntax ?
> The ComputedID DataConnector 
> (https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector) 
> builds the hashed value from the source attribute, the same as the 
> shibboleth.ComputedPersistentIdGenerator does.  The 
> eduPersonTargetedID attribute definition encodes it as a 
> SAML2XMLObject, which is what the SP is expecting.
>
> Once you have the eduPersonTargetedID attribute generated, modify 
> attribute-filter.xml to release it to the SP (the same way as any 
> other attribute is released).
ok this was already done
>
> BTW, you may want to choose a different sourceAttribute than 
> eduPersonPrincipalName.  You need a source attribute that is 
> persistent (long-lived and never re-used for a different 
> person/subject).  Maybe eduPersonPrincipalName meets those 
> requirements for you, maybe not.  We used an internal IDM-generated 
> identifier as our source attribute instead.
for now eppn is not reused, but you are right, I will consider perhaps a 
better sourceAttribute .
>
> Good luck!
>
> Thanks,
>     Andy
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171218/db702f42/attachment.html>