Persistent NameID generation

[Boyd, Todd M.]

Boyd’s my last name – our corporate email uses reverse order for sorting. :) At any rate, I tried it with “SHA” as the algorithm, but that is the default, anyway. It shouldn’t matter.


-Todd

From: users <users-bounces at shibboleth.net> On Behalf Of Karla Borecky
Sent: Monday, April 30, 2018 2:19 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Persistent NameID generation

Hi Boyd,

I don't know if you mean the rest of your saml-nameid.properties file was literally commented out, but under my persistentId source attribute and salt, there is this line

idp.persistentId.algorithm = SHA

The only other thing I can think of is, are you releasing the source attribute in your attribute filter?

cheers,
Karla B

On Mon, Apr 30, 2018 at 2:56 PM, Boyd, Todd M. <tmboyd1 at ccis.edu<mailto:tmboyd1 at ccis.edu>> wrote:
Here's the entire shibboleth.SAML2NameIDGenerators section of saml-nameid.xml:

        <util:list id="shibboleth.SAML2NameIDGenerators">

                <ref bean="shibboleth.SAML2TransientGenerator" />

                <ref bean="shibboleth.SAML2PersistentGenerator" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                        p:format="urn:oid:1.3.6.1.4.1.32548.1.1.2"
                        p:attributeSourceIds="#{ {'campusPermanentId'} }" />

                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                        p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                        p:attributeSourceIds="#{ {'mail'} }" />

        </util:list>

Was there something else I needed to add, or is this from an older version of the config? Should it be a <bean /> element and not a <ref /> element for some reason?

-Todd


-----Original Message-----
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Cantor, Scott
Sent: Monday, April 30, 2018 1:39 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Persistent NameID generation

> Any suggestions on where else I could
> check to troubleshoot further?

It isn't likely you uncommented the generator bean based on that, there are enough DEBUG log lines in there that should show up.

-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180430/75b94b09/attachment.html>