Cleaning up deprecated transientId definition in a v3 IdP

[Karla Borecky]

Hello,

I'm looking to clean this up but I have some questions, when someone has a
moment.

This is what it looks like I need to do - but I am unsure about some things.

1. Uncomment this line in saml-nameid.properties:

#idp.transientId.generator = shibboleth.CryptoTransientIdGenerator


  Question: What about these lines? Should they also be uncommented?

# Default NameID formats to use when nothing else is called for
#idp.nameid.saml2.default =
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
#idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier


2. Remove/comment out this section of the attribute-resolver file:

<resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>


3. Do I need to put anything additional in the saml-nameid.xml file to
actually generate the transientId? If not, I don't see where it actually
gets the name 'transientId' (unless it's built in.)

4. Do you control its release it in the attribute-filter file still when
you use this new method? Or is that handled by the 'default NameID formats"
section (above)?

Sorry to be confused! I have a number of customized nameid's in my
saml-nameid.xml file but they all have source attributes, of course, so I'm
not really sure how this special case works.

Thank you,
Karla B

-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170201/ca190326/attachment.html>