Forcing Misuse of TransientID in IdP 3.2.

[Sheldon, Nathan I]

Hi folks.

Is it possible to configure the SAML2TransientGenerator to send an attribute sourced value (similar to a persistent ID or other non-transient NameID)?  If so, is there documentation on how this might be done?

Why you might ask?  A (well known database) vendor’s application already integrated with our soon-to-be upgraded IdP version 2.3.8 environment requires a NameID in the SAML response with a format defined as "urn:oasis:names:tc:SAML:2.0:nameid-format:transient” but whose actual value is a user ID which they use as their primary key for the application.  It was successfully integrated (by someone before my tenure) with our IdP 2.3.8 environment by adding
——
    <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
        nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
——
to the attribute definition in the attribute-resolver.xml configuration.

I’ve informed the application owner that this misuse of the NameID format will need to be changed, but it’s rather unlikely they’ll be able to get the vendor to modify their code before we need to put IdP 3.3 into production.

I’ve tried adding the below bean to the SAML2NameIDGenerators list in the conf/saml-nameid.xml configuration.
——
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
            p:attributeSourceIds="#{ {
                'uidNameID'
            } }">
        </bean>
——
but the NameID value produced in the SAML response still contains the generated transient ID string rather than the attribute value.

The “uidNameID” attribute is defined in the attribute-resolver.xml and the SAML response includes that attribute and correct value.

----
Nathan Sheldon
IAM Support Engineer
    Identity and Access Management,
    Information Technology Services
University of California, San Francisco





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170131/a85888a0/attachment.html>