How do i get eduPersonTargetedID to be the same as the persistent NameID ?

[McLennan, Neil R]

Dear All,

How do I get eduPersonTargetedID the same as the NameID?

My Shibboleth v2 gives

<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibboleth.imperial.ac.uk/shibboleth" SPNameQualifier="https://icsamlsdp.cc.ic.ac.uk/simplesaml/module.php/saml/sp/metadata.php/shibboleth">
                  s8xD6YLaw8o9ljgBli/XzUlxsZw=</saml2:NameID>

<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibboleth.imperial.ac.uk/shibboleth" SPNameQualifier="https://icsamlsdp.cc.ic.ac.uk/simplesaml/module.php/saml/sp/metadata.php/shibboleth">s8xD6YLaw8o9ljgBli/XzUlxsZw=</saml2:NameID>
         </saml2:AttributeValue>

My Shibboleth v3 gives


                       <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

                                                            NameQualifier="https://shibboleth.imperial.ac.uk/shibboleth"

                                                            SPNameQualifier="https://icsamlsdp.cc.ic.ac.uk/simplesaml/module.php/saml/sp/metadata.php/shibboleth"

                                                            >s8xD6YLaw8o9ljgBli/XzUlxsZw=</saml2:NameID>


                       <saml2:Attribute FriendlyName="eduPersonTargetedID"
                                                               Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
                                                               NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                                                               >
                                                             <saml2:AttributeValue>YluupYx32fmN2/5XFOwXvZAO1zU=</saml2:AttributeValue>
                                              </saml2:Attribute>

On Shibboleth v2 I have

<resolver:AttributeDefinition xsi:type="Simple" id="persistentId" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="computedID">
        <resolver:Dependency ref="computedID" />
                <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
                <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
</resolver:AttributeDefinition>


    <resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"
                                  nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID">
        <resolver:Dependency ref="computedID" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
    </resolver:AttributeDefinition>

    <resolver:DataConnector xsi:type="dc:ComputedId"
                            id="computedID"
                            generatedAttributeID="computedID"
                            sourceAttributeID="eduPersonPrincipalName"
                            salt="alllowercaseletters">
        <resolver:Dependency ref="myLDAP" />
    </resolver:DataConnector>

ON Shibboleth v3

In saml-nameid.properties

idp.persistentId.sourceAttribute = eduPersonPrincipalName
#idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like divulging your private key.
#idp.persistentId.algorithm = SHA
idp.persistentId.salt = imperialcollegelondon
# BASE64 will match V2 values, we recommend BASE32 encoding for new installs.
idp.persistentId.encoding = BASE64

# To use a database, use shibboleth.StoredPersistentIdGenerator
idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator

In saml-nameid

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
        <ref bean="shibboleth.SAML2PersistentGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:omitQualifiers="true"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'computedID'} }" />

    </util:list>

And in attribute-resolver.xml

    <AttributeDefinition id="eduPersonTargetedID" xsi:type="Simple">
        <InputDataConnector ref="ComputedIDConnector" attributeNames="ComputedID" />
        <AttributeEncoder xsi:type="SAML1String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" encodeType="false" />
    </AttributeDefinition>
<DataConnector id="ComputedIDConnector" xsi:type="ComputedId"
    generatedAttributeID="ComputedID"
    salt="alllowercaseletters">
   <InputDataConnector ref="myLDAP" attributeNames="eduPersonPrincipalName" />
</DataConnector>


Regards

Neil McLennan
Imperial College London




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190613/d9820443/attachment.html>