IdPv3 and Hathitrust: how to resolve and release SAML V2.0 persistent NameID

[Cantor, Scott]

On 7/7/17, 3:19 PM, "users on behalf of Wang, Lihua" <users-bounces at shibboleth.net on behalf of lwang2 at gc.cuny.edu> wrote:

> But what do we need to do to resolve the persistent NameID and release it to a service provider?

Define sAMAccountName as a resolved attribute, and use an appropriate mechanism to trigger the use of that Format. An InCommon SP's metadata will not do that for you, so they ideally shouldn't be using NameIDs at all, but you'd have to force the right Format to get chosen. You either add a NameIDFormat at runtime to the metadata using a metadata filter, or you have to configure a relying party override with a nameIDFormatPrecedence setting to force it.

You can't just configure the format. It has to be chosen. The set of NameID Formats is infinite. There is no way for the IdP to know which one to use. Either the SP asks, its metadata specifies it, or you tell it. Otherwise you get the default, and the default is "transient".

Personally I wouldn't bother, and I would not use sAMAccountName as a seed. What are you using in AD for that? Anything that's not stable is not appropriate as an input to that process, and most of those tend to be usernames or other questionably stable data.

If this SP doesn't *require* all this, then I wouldn't bother. And I don't think it does.

-- Scott