Cleaning up deprecated transientId definition in a v3 IdP

[Cantor, Scott]

On 2/1/17, 3:58 PM, "users on behalf of Karla Borecky" <users-bounces at shibboleth.net on behalf of kborecky at smith.edu> wrote:

> 1. Uncomment this line in saml-nameid.properties:

Uncommenting a property generally speaking does nothing, you're just explicitly setting something to its default value.  You uncomment things to change them.
    
> 2. Remove/comment out this section of the attribute-resolver file:

All unused and ignored unless you start turning off the V3 features that handle the format.

> 3. Do I need to put anything additional in the saml-nameid.xml file to actually generate the transientId? If not, I don't see
> where it actually gets the name 'transientId' (unless it's built in.)

<ref bean="shibboleth.SAML2TransientGenerator" />

That's what it does.

There is nothing called "transientId". This isn't an attribute. It never should have been in the first place, that was a mistake that did nothing but confuse everything.

>    4. Do you control its release it in the attribute-filter file still when you use this new method? Or is that handled by the
> 'default NameID formats" section (above)?

It was wrong to control it with the filter before and it is wrong (and now actually impossible) to control it there now.
        
>    Sorry to be confused! I have a number of customized nameid's in my saml-nameid.xml file but they all have source
> attributes, of course, so I'm not really sure how this special case works.

It isn't a special case. Name IDs are never attributes. There are plugins that generate them in different ways and the plugins have formats assigned either inside their implementation or via a bean property. Some plugins might be self-contained and some of them might support pulling other data in. The transient generators happen to be self-contained.

NameIDs are not controlled with filter rules and I do not suggest relying on filtering of source attributes to determine whether some layered NameID happens to be accessible to something, that's just an incidental and indirect way of telling it what you mean, but that's just my opinion. That's why the generators can be layered on attributes that might be unreleased in and of themselves.

-- Scott