Persistent ID via eduPersonTargetedID in IdP 2.4.4

[Kylie Lunghusen]

Hi folks,



Apologies in advance for n00b question. I searched pretty exhaustively
before deciding to ask here, but couldn't find anything obviously relevant
to our specfic config and don't understand this well enough to figure it
out.



I've inherited the running of our Shibboleth IdP, and I can't get
persistentID-via-eduPersonTargetedID working properly. Shibboleth version
is 2.4.4 (yes I know; upgrade project is underway but will take a while).



We have an SP wanting to use persistentID as a NameID, but the SAML
response shows it in the Subject's NameID element as
"org.opensaml.saml2.core.impl.NameIDImpl at 4b598f0e" (or similar) instead of
the expected persistentID string:

------------------------------------------------------------------------------

       <saml2:Subject>

           <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

                         NameQualifier="https://[OUR_IDP]/idp/shibboleth"

                         SPNameQualifier="https://
[THEIR_SP]/lnaccess/fed/authn"

                         >org.opensaml.saml2.core.impl.NameIDImpl at 8941ef9
</saml2:NameID>

------------------------------------------------------------------------------

The SAML response AttributeValue for "eduPersonTargetedID" contains the
following:

------------------------------------------------------------------------------

           <saml2:Attribute FriendlyName="eduPersonTargetedID"

                            Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"


NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"

                            >

               <saml2:AttributeValue>

                  <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
                                 NameQualifier="https://
[OUR_IDP]/idp/shibboleth"
                                 SPNameQualifier="https://
[THEIR_SP]/lnaccess/fed/authn"
                                 >f3X2yWQUJ8CIEuQcCsOTGKOQ+M0=</saml2:NameID>

------------------------------------------------------------------------------

...which I suspect is what we want to be seeing in the subject.



The closest thing my research found suggested editing attribute resolver to
change the ePTID AttributeDefinition's xsi:type from "ad:SAML2NameID" to
"Simple", but when I deployed that to Dev environment, it wouldn't start
Shibboleth, and gave "Attribute 'nameIdFormat' is not allowed to appear in
element 'resolver:AttributeDefinition'." in idp-process.log.



Extracts from current attribute resolver config:

------------------------------------------------------------------------------

.

.

.

 <resolver:AttributeDefinition id="eduPersonTargetedID"
xsi:type="ad:SAML2NameID"

nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

sourceAttributeID="persistentID">

   <resolver:Dependency ref="myStoredId" />



   <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"

                   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />



   <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"

                   name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" />



   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"


nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

                   />



 </resolver:AttributeDefinition>

.

.

.

 <!-- StoredID (persistentID) Connector -->

 <resolver:DataConnector id="myStoredId"

 xsi:type="dc:StoredId"

 generatedAttributeID="persistentID"

 sourceAttributeID="uid"

 salt="__PERSISTENT_ID_SALT__">

   <resolver:Dependency ref="myLDAP" />



   <dc:ApplicationManagedConnection

jdbcDriver="__PERSISTENT_ID_DATABASE_DRIVER__"

       jdbcURL="__PERSISTENT_ID_DATABASE_URL__"

       jdbcUserName="__PERSISTENT_ID_DATABASE_USERNAME__"

       jdbcPassword="__PERSISTENT_ID_DATABASE_PASSWORD__"

poolAcquireRetryAttempts="90"

poolBreakAfterAcquireFailure="false"

/>

 </resolver:DataConnector>

.

.

.

 <resolver:PrincipalConnector

     xsi:type="pc:StoredId"

     id="saml2Persistent"

     nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

     storedIdDataConnectorRef="myStoredId" />

.

.

.

------------------------------------------------------------------------------



Extract from attribute filters config:

------------------------------------------------------------------------------

.

.

.

 <afp:AttributeFilterPolicy id="afp_for:https://
[THEIR_SP]/lnaccess/fed/authn">

   <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"

         value="https://[THEIR_SP]/lnaccess/fed/authn"/>

   <afp:AttributeRule attributeID="uid">

     <afp:PermitValueRule xsi:type="basic:ANY" />

   </afp:AttributeRule>

   <afp:AttributeRule attributeID="eduPersonTargetedID">

     <afp:PermitValueRule xsi:type="basic:ANY" />

   </afp:AttributeRule>

   <afp:AttributeRule attributeID="mail">

     <afp:PermitValueRule xsi:type="basic:ANY" />

   </afp:AttributeRule>

.

.

.

------------------------------------------------------------------------------


Can anyone please advise, based on our current config, what I'd have to
change to make a proper persistentID string appear in the Subject instead
of that "...NameIDImpl at ..." string?



Please let me know if there's any more information I need to provide.



Thanks in advance,


--
Kylie Lunghusen
Technical Tools Administrator, University Operations
Information Technology Services, RMIT University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170703/7593761f/attachment-0001.html>