Persistent NameID

[Fred Newtz (frnewtz)]

Hello,

I am definitely feeling much better about Shibboleth now after digging through the links that were provided last week.  I appreciate every who took the time to respond.  I have everything setup and working so far.  The final piece of the puzzle is the NameID.  Our SP requires a persistent NameID and it wants it in the format of an email address.

Digging through the documentation on NameID’s it mentions using a database to store Persistent NameIDs.  It looks like there is quite a bit of things that can happen with these NameIDs.  I don’t want to create a hash or do anything like that, since the information is already sitting in Active Directory and is being returned then I don’t feel like a database is honestly required here. If it is that is fine and I can easily get this all setup based on the wiki.

Do I need to setup a database server just to use Persistent NameID’s?

I see the shibboleth.SAML2AttributeSourcedGenerator in the saml-nameid.xml file.  It is using mail as the nameid there.  Can I just uncomment the shibboleth.SAML2PersistentGenerator and the above mentioned bean right below it and be good?

If I want to use mail for a persistent NameID what do I need to do in the saml-nameid.properties file to make the persistent configuration work properly?

Thanks,

Fred
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170216/436e271f/attachment.html>