SAML nameid generation defaults to transient

[Peter Schober]

* Lipscomb, Gary <glipscomb at csu.edu.au> [2018-05-15 05:33]:
> I have specified the format in the saml-nameid.xml [4] file
> below. It defaults to creating a transient nameid [5].

That's to be expected and documented. Metadata or an authnrequest or
your relying party config will influence the NameID selection
process. Simply having it defined (and also releasing an attribute it
may be based on) is not sufficient.

> [3] attribute-resolver.xml
> 
>    <AttributeDefinition xsi:type="Simple"
>        id="XXXXAsNameID"
>        sourceAttributeID="internal-CSU">
>      <Dependency ref="internal-CSU" />
>    </AttributeDefinition>
> 
> [4] saml-nameid.xml
[...]
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>                   p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>                   p:attributeSourceIds="#{ {'XXXXAsNameID'} }">
>             <property name="activationCondition">
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
>                   c:candidates="#{ {'https://adminuat.dc2.pp.com/', 'https://admin.dc2.pp.com/'} }" />
>             </property>
>         </bean>

Note that the above is not a legal persistent NameID (cf. SAML Core).

-peter