activation conditions on persistent nameid

[Andrew Morgan]

I've done something bad, and I want to know how bad...  :)

While trying to roll-out Docusign, which requires a persistent NameID, I 
realized that I am sending our EPPN as a persistent NameID to Webex.  I 
didn't know better when I originally configured Webex.  When I enabled the 
default persistent NameID generator, we started sending a different value 
to Webex.

As I was playing around with the configuration on a test server, I found a 
way to use activation conditions to release a different value to Webex. 
In saml-nameid.xml, I have:

<!-- copied from system/conf/saml-nameid-system.xml -->
<bean id="shibboleth.SAML2PersistentGenerator" lazy-init="true"
         class="net.shibboleth.idp.saml.nameid.impl.PersistentSAML2NameIDGenerator"
         p:useUnfilteredAttributes="%{idp.persistentId.useUnfilteredAttributes:true}"
         p:persistentIdGenerator-ref="#{'%{idp.persistentId.generator:shibboleth.ComputedPersistentIdGenerator}'.trim()}">
     <property name="attributeSourceIds">
       <bean parent="shibboleth.CommaDelimStringArray" c:_0="#{'%{idp.persistentId.sourceAttribute:}'.trim()}" />
     </property>
     <property name="activationCondition">
       <bean parent="shibboleth.Conditions.NOT">
         <constructor-arg>
           <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://oregonstate-staff.webex.com" />
         </constructor-arg>
       </bean>
     </property>
</bean>

<!-- custom bean for webex -->
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
     p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
     p:attributeSourceIds="#{ {'webex-principal'} }">
     <property name="activationCondition">
       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://oregonstate-staff.webex.com" />
     </property>
</bean>


I couldn't figure out how else to attach an activation condition to the 
default persistent NameID generator when it is a <ref> element.

I may be able to reconfigure Webex to use a different NameID, but I'll 
have to open a case with Webex to understand what crazy rules they are 
using when the format is changed.

Thanks,
 	Andy