persitentID nameID for specific SPs, transient for default
Jehan Procaccia
jehan.procaccia at tem-tsp.eu
Tue Dec 19 09:28:31 EST 2017
Le 18/12/2017 à 19:51, Andrew Morgan a écrit :
> On Mon, 18 Dec 2017, jehan procaccia wrote:
>
>> perhaps the warning mention on
>> https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector
>> regarding different xml schema whether we use 3.3 or lower , mine 3.2 !?
>>
>>
>> is there something wrong in my syntax ?
>
> Here is the same configuration before the XML namespace change:
>
> <resolver:DataConnector xsi:type="dc:ComputedId"
> id="computedID"
> generatedAttributeID="computedID"
> sourceAttributeID="%{idp.persistentId.sourceAttribute}"
> salt="%{idp.persistentId.salt}">
> <resolver:Dependency ref="myLDAP" />
> </resolver:DataConnector>
>
> <resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
> id="eduPersonTargetedID"
> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> sourceAttributeID="computedID">
> <resolver:Dependency ref="computedID" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
> friendlyName="eduPersonTargetedID" />
> </resolver:AttributeDefinition>
>
>
> Thanks,
> Andy
>
thanks, that works fine now with your example using the 3.2 XML namespace .
So I though that now I could access that SP as I send it correct
PersistendID and EPTID , but it still loops on the login process with no
specific error message .
I wrote to SPs technical contact with that long thread we had here as a
reference , I'am waiting for a reponse, but if someone on the list can
confirme that he/she can acces that SP I would be assured that the pb
still reside on my IDP and not monitor.eduroam.org SP !.
here is the SAML assertion my IDP finally sends to that SP :
2017-12-19 13:38:33,906 - DEBUG
[org.opensaml.saml.saml2.profile.impl.EncryptAssertions:132] - Profile
Action EncryptAssertions: Assertion before encryption:
<?xml version="1.0" encoding="UTF-8"?>
<saml2:Assertion ID="_f4d649d8cada1f44d2efa5ff53ff3324"
IssueInstant="2017-12-19T12:38:33.763Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer>https://idp3.tem-tsp.eu/idp/shibboleth</saml2:Issuer>
<saml2:Subject>
*<saml2:NameID**
**Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"*
NameQualifier="https://idp3.tem-tsp.eu/idp/shibboleth"
SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">cypRgyH6cq0Iifq1UFZGlgCKLDB=</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="91.160.129.124"
InResponseTo="_652d7ff66093e86dc79aa45711b99f7dfdcf7a2501"
NotOnOrAfter="2017-12-19T12:43:33.835Z"
Recipient="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2017-12-19T12:38:33.763Z"
NotOnOrAfter="2017-12-19T12:43:33.763Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2017-12-19T12:38:27.135Z"
SessionIndex="_26a4eacab6d659a933907f74b73cf807">
<saml2:SubjectLocality Address="91.160.129.124"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">procaccia</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="mail"
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">jehan.procaccia at tem-tsp.eu</saml2:AttributeValue>
</saml2:Attribute>
*<saml2:Attribute FriendlyName="eduPersonTargetedID"**
** Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">**
** <saml2:AttributeValue>**
** <saml2:NameID**
**Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"**
**NameQualifier="https://idpr3.tem-tsp.eu/idp/shibboleth"
SPNameQualifier="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">cypRgyH6cq0Iifq1UFZGlgCKLDB=</saml2:NameID>*
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonPrincipalName"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">procaccia at tem-tsp.eu</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
2017-12-19 13:38:34,036 - INFO [Shibboleth-Audit.SSO:241] -
20171219T123834Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_652d7ff66093e86dc79aa45711b99f7dfdcf7a2501|https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idpr3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e20f43530af84efaaf7f001d4ecc0f6f|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|
uid,mail,*eduPersonTargetedID*,eduPersonPrincipalName|cypRgyH6cq0Iifq1UFZGlgCKLDA=|_f4d649d8cada1f44d2efa5ff53ff3324|
regards .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171219/33644611/attachment-0001.html>
More information about the users
mailing list