Help with Persistent NameID

[Jason Rotunno]

Hi All,

We're running Shibboleth 3.3.x and in the past I've setup several SP's to
use persistent IDs. For example:

conf/saml-nameid.xml

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent"
             p:attributeSourceIds="#{ {'employeeID'} }">
             <property name="activationCondition">
                 <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="SOMEID" />
             </property>
         </bean>

conf/relying-party.xml

        <bean parent="RelyingPartyByName" c:relyingPartyIds="SOMEID">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
                          p:includeAttributeStatement="true"
                          p:assertionLifetime="PT5M"
                          p:signResponses="true"
                          p:signAssertions="true"
                          p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

conf/metadata-providers.xml

        <metadata:MetadataProvider id="SP_NAME"
xsi:type="metadata:FilesystemMetadataProvider"
                          xmlns="urn:mace:shibboleth:2.0:metadata"
                          metadataFile="/path/to/sp-metadata.xml">
        </metadata:MetadataProvider>


employeeID as defined in conf/attribute-resolver.xml

        <resolver:AttributeDefinition xsi:type="ad:Simple" id="employeeID"
sourceAttributeID="eID">
            <resolver:Dependency ref="eID" />
            <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent" />
        </resolver:AttributeDefinition>

And I made sure employeeID is being released to the SP in
conf/relying-filter.xml.

I'm attempting to setup a new SP the same way, but for some reason it's
still using a transient NameID. It's as if the activation condition isn't
being triggered.

   - Am I correct that the c:candidate value in conf/saml-nameid.xml should
   be the entityID in the SP's metadata?
   - If not, what should that value be?
   - If so, does anyone have any ideas of some common mistakes I should
   double check for?

If I should provide some additional info, just let me know.

Thanks,
Jason



-- 

Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505

Think BEFORE You Click!! Emails from Swarthmore College ITS won't be in your
Quarantine or Spam folder. We won't threaten you either! If you
receive any phishing emails, please forward them to phishing at swarthmore.edu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181001/410c74e8/attachment.html>