Forcing Misuse of TransientID in IdP 3.2.

[IAM David Bantz]

don't you need to add clause to indicate that nameID is used for specific
SP(s)? like

                       <property name="activationCondition">
>                                 <bean
> parent="shibboleth.Conditions.RelyingPartyId"
>                                                 c:candidates="#{ {
>                                                 '
> https://very.special.sp.com'
>                                                  } }" />
>                         </property>


On Tue, Jan 31, 2017 at 10:41 AM, Sheldon, Nathan I <Nathan.Sheldon at ucsf.edu
> wrote:

> Hi folks.
>
> Is it possible to configure the SAML2TransientGenerator to send an
> attribute sourced value (similar to a persistent ID or other non-transient
> NameID)?  If so, is there documentation on how this might be done?
>
> Why you might ask?  A (well known database) vendor’s application already
> integrated with our soon-to-be upgraded IdP version 2.3.8 environment
> requires a NameID in the SAML response with a format defined as
> "urn:oasis:names:tc:SAML:2.0:nameid-format:transient” but whose actual
> value is a user ID which they use as their primary key for the
> application.  It was successfully integrated (by someone before my tenure)
> with our IdP 2.3.8 environment by adding
> ——
>     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
>         nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:
> transient" />
> ——
> to the attribute definition in the attribute-resolver.xml configuration.
>
> I’ve informed the application owner that this misuse of the NameID format
> will need to be changed, but it’s rather unlikely they’ll be able to get
> the vendor to modify their code before we need to put IdP 3.3 into
> production.
>
> I’ve tried adding the below bean to the SAML2NameIDGenerators list in the
> conf/saml-nameid.xml configuration.
> ——
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>             p:attributeSourceIds="#{ {
>                 'uidNameID'
>             } }">
>         </bean>
> ——
> but the NameID value produced in the SAML response still contains the
> generated transient ID string rather than the attribute value.
>
> The “uidNameID” attribute is defined in the attribute-resolver.xml and the
> SAML response includes that attribute and correct value.
>
> ----
> Nathan Sheldon
> IAM Support Engineer
>     Identity and Access Management,
>     Information Technology Services
> University of California, San Francisco
>
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170131/79686e91/attachment.html>