nameid-format:unspecified for relying party

[Baron Fujimoto]

Doh! That's twice now recently that I've had the list point out my stupid typos. *sigh*

Unfortunately however, despite correcting the typo, it doesn't seem to have had any effect. It still returns

    <saml2:Subject>
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
            NameQualifier="https://example.edu/idp/shibboleth" SPNameQualifier="sp.foo.bar">AAd...uTM</saml2:NameID>
    </saml2:Subject>

saml-nameid.xml:

    <util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'principal'} }" />
    </util:list>

Is there anything  that should be set for this in saml-nameid.properties?

"principal" is defined in attribute-resolver.xml with:

    <resolver:AttributeDefinition xsi:type="ad:PrincipalName"
            id="principal" >
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
                nameFormat="urn:oid:0.9.2342.19200300.100.1.1" />

On Wed, Jun 27, 2018 at 09:25:41PM +0000, Boyd, Todd M. wrote:
>Your saml-nameid.xml appears to have a typo:
>
>	p:format="rn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
>
>Should be:
>
>	p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
>
>It's missing the "u" at the beginning of "urn".
>
>
>-Todd
>
>
>-----Original Message-----
>From: users <users-bounces at shibboleth.net> On Behalf Of Baron Fujimoto
>Sent: Wednesday, June 27, 2018 4:20 PM
>To: Shib Users <users at shibboleth.net>
>Subject: nameid-format:unspecified for relying party
>
>We have an SP that requires the NameID to be encoded with nameid-format:unspecified.
>
>Currently, our IdP appears to return nameid-format:transient by default. E.g.:
>
>    <saml2:Subject>
>        <saml2:NameID
>            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>            NameQualifier="https://example.edu/idp/shibboleth" SPNameQualifier="sp.foo.bar">AAd...dII</saml2:NameID>
>    </saml2:Subject>
>
>We still retain legacy V2 configurations from our upgrade to V3. We have the following uncommented in saml-nameid.properties:
>
>idp.nameid.saml2.legacyGenerator= shibboleth.LegacySAML2NameIDGenerator
>idp.nameid.saml1.legacyGenerator= shibboleth.LegacySAML1NameIdentifierGenerator
>
>And this definition in attribute-resolver.xml:
>
>    <resolver:AttributeDefinition xsi:type="ad:TransientId"
>            id="transientId">
>        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
>                nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
>                nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
>    </resolver:AttributeDefinition>
>
>Our saml-nameid.xml includes:
>
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>            p:format="rn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
>            p:attributeSourceIds="#{ {'principal'} }" />
>
>The SP's documentation instructs:
>
>"Paste [this] inside the shibboleth.RelyingPartyOverrides elements to override the default configuration for the Shibboleth Identity Provider"
>
>    <bean parent="RelyingPartyByName" c:relyingPartyIds="sp.foo.bar">
>    <property name="profileConfigurations">
>        <list>
>            <bean parent="SAML2.SSO" 
>             p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
>        </list>
>    </property>
>    </bean>
>
>"The nameIDFormatPrecedence parameter instructs the IDP to send the SAML name ID attribute in the unspecified format"
>
>"Turn off assertion encryption in the Shibboleth Identity Provider by setting the encryptAssertions parameter to false."
>
>    <bean parent="RelyingPartyByName" c:relyingPartyIds="sp.foo.bar">
>        <property name="profileConfigurations">
>            <list>
>                <bean parent="SAML2.SSO" 
>                    p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" 
>                    p:encryptAssertions="false" />
>            </list>
>        </property>
>    </bean>
>
>However, I'm not familiar with shibboleth.RelyingPartyOverrides in our configs, so attempted the following in our relying-party.xml:
>
>    <RelyingParty id="sp.foo.bar"
>            provider="https://example.edu/idp/shibboleth"
>            nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
>            defaultSigningCredentialRef="IdPCredential">
>        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
>    </RelyingParty>
>
>But this does not appear to having the desired effect. The SP reports the error "'NAME_ID' not found in SAML response" so perhaps the these RelyingPartyOverrides do not belong in the relying party entry?
>
>Any suggestions would be appreciated.
>
>--
>Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>--
>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>-- 
>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum