nameid-format:unspecified for relying party

[Boyd, Todd M.]

Your saml-nameid.xml appears to have a typo:

	p:format="rn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"

Should be:

	p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"

It's missing the "u" at the beginning of "urn".


-Todd


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Baron Fujimoto
Sent: Wednesday, June 27, 2018 4:20 PM
To: Shib Users <users at shibboleth.net>
Subject: nameid-format:unspecified for relying party

We have an SP that requires the NameID to be encoded with nameid-format:unspecified.

Currently, our IdP appears to return nameid-format:transient by default. E.g.:

    <saml2:Subject>
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
            NameQualifier="https://example.edu/idp/shibboleth" SPNameQualifier="sp.foo.bar">AAd...dII</saml2:NameID>
    </saml2:Subject>

We still retain legacy V2 configurations from our upgrade to V3. We have the following uncommented in saml-nameid.properties:

idp.nameid.saml2.legacyGenerator= shibboleth.LegacySAML2NameIDGenerator
idp.nameid.saml1.legacyGenerator= shibboleth.LegacySAML1NameIdentifierGenerator

And this definition in attribute-resolver.xml:

    <resolver:AttributeDefinition xsi:type="ad:TransientId"
            id="transientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
                nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
                nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

Our saml-nameid.xml includes:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="rn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'principal'} }" />

The SP's documentation instructs:

"Paste [this] inside the shibboleth.RelyingPartyOverrides elements to override the default configuration for the Shibboleth Identity Provider"

    <bean parent="RelyingPartyByName" c:relyingPartyIds="sp.foo.bar">
    <property name="profileConfigurations">
        <list>
            <bean parent="SAML2.SSO" 
             p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
        </list>
    </property>
    </bean>

"The nameIDFormatPrecedence parameter instructs the IDP to send the SAML name ID attribute in the unspecified format"

"Turn off assertion encryption in the Shibboleth Identity Provider by setting the encryptAssertions parameter to false."

    <bean parent="RelyingPartyByName" c:relyingPartyIds="sp.foo.bar">
        <property name="profileConfigurations">
            <list>
                <bean parent="SAML2.SSO" 
                    p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" 
                    p:encryptAssertions="false" />
            </list>
        </property>
    </bean>

However, I'm not familiar with shibboleth.RelyingPartyOverrides in our configs, so attempted the following in our relying-party.xml:

    <RelyingParty id="sp.foo.bar"
            provider="https://example.edu/idp/shibboleth"
            nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            defaultSigningCredentialRef="IdPCredential">
        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
    </RelyingParty>

But this does not appear to having the desired effect. The SP reports the error "'NAME_ID' not found in SAML response" so perhaps the these RelyingPartyOverrides do not belong in the relying party entry?

Any suggestions would be appreciated.

--
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net