SAML nameid generation defaults to transient

[Lipscomb, Gary]

Peter,

>Note that the above is not a legal persistent NameID (cf. SAML Core).
Understand that but thats what the vendor wants. Tried to convince them to accept it as an attribute but they said no. The software was already decided on before IT was involved and they could do SAML SSO.

Thanks for clearing up the mis-understanding of saml-nameid release.

regards
Gary
________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Tuesday, 15 May 2018 8:55 PM
To: users at shibboleth.net
Subject: Re: SAML nameid generation defaults to transient

* Lipscomb, Gary <glipscomb at csu.edu.au> [2018-05-15 05:33]:
> I have specified the format in the saml-nameid.xml [4] file
> below. It defaults to creating a transient nameid [5].

That's to be expected and documented. Metadata or an authnrequest or
your relying party config will influence the NameID selection
process. Simply having it defined (and also releasing an attribute it
may be based on) is not sufficient.

> [3] attribute-resolver.xml
>
>    <AttributeDefinition xsi:type="Simple"
>        id="XXXXAsNameID"
>        sourceAttributeID="internal-CSU">
>      <Dependency ref="internal-CSU" />
>    </AttributeDefinition>
>
> [4] saml-nameid.xml
[...]
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>                   p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>                   p:attributeSourceIds="#{ {'XXXXAsNameID'} }">
>             <property name="activationCondition">
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
>                   c:candidates="#{ {'https://adminuat.dc2.pp.com/', 'https://admin.dc2.pp.com/'} }" />
>             </property>
>         </bean>

Note that the above is not a legal persistent NameID (cf. SAML Core).

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net