V2 to v3 Config change help

[James Drews]

I'm working on getting our configs out of the v2 legacy and on the the v3 style (so we won't break when the legacy configs finally deprecate).

One of the things I'm trying to do is get a persistentID set up, but am slightly confused.

I've updated the saml-nameid.properties file:

idp.transientId.generator = shibboleth.CryptoTransientIdGenerator
idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator
idp.persistentId.store = CAEPersistentIdStore
idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator
idp.persistentId.sourceAttribute = uid
idp.persistentId.salt = xxxx
idp.persistentId.algorithm = SHA
idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier

(ie, taken out the legacy, and set up the above).

I believe the persistentid.store is set up correctly. At one point in the logs I saw a "table does not exist" error, and realized I didn't give the db account rights to it. After granting rights, the error went away, so pretty sure that's right.

In the idp-process.log, I see:

2017-01-26 14:48:40,340 - DEBUG [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:720] - Stored Id Store: Storing new persistent ID entry
2017-01-26 14:48:40,386 - DEBUG [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:720] - Stored Id Store: Storing new persistent ID entry
2017-01-26 14:48:40,402 - INFO [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:495] - Stored Id Store: Data source successfully verified

But after someone authenticates to the IDP, I don't see any entries in the table.

Saml-nameid.xml has the
<ref bean="shibboleth.SAML2PersistentGenerator" />
uncommented

and the store defined as:
    <bean id="CAEPersistentIdStore" class="net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx"
         p:dataSource-ref="shibboleth.JPAStorageService.DataSource"
                p:tableName="cae.shibpid_dev"
         p:queryTimeout="PT2S"

    />

Thoughts?

The other bit I'm confused about, do I need an entry in attribute-resolver.xml for a persistentID entry? And if so, what Dependency reference do I give it now?

Thanks
James



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170126/070cb385/attachment-0001.html>