How do i get eduPersonTargetedID to be the same as the persistent NameID ?

[Peter Schober]

* McLennan, Neil R <n.mclennan at imperial.ac.uk> [2019-06-13 16:28]:
> <saml2:Attribute FriendlyName="eduPersonTargetedID"
>   Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
>   NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>   <saml2:AttributeValue>YluupYx32fmN2/5XFOwXvZAO1zU=</saml2:AttributeValue>
> </saml2:Attribute>

That's your mistake: The attibute value of an ePTID attribute MUST be
a NameID XML element, not a simple string value.

> On Shibboleth v2 I have
> 
>     <resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"
>                                   nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID">
>         <resolver:Dependency ref="computedID" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
>     </resolver:AttributeDefinition>

The config for IDPv3 looks pretty much the same, see below.

> ON Shibboleth v3
> 
> In saml-nameid.properties

saml-nameid.* are irrelevant for eduPersonTargetedID *attributes*,
though you could re-use the properties defined there
(idp.persistentId.sourceAttribute, idp.persistentId.salt)
as I suggest below.

> # Do *NOT* share the salt with other people, it's like divulging your private key.
> idp.persistentId.salt = imperialcollegelondon

I do hope you've replaced this in the email you've just sent to the world.

>     <!-- SAML 2 NameID Generation -->
>     <util:list id="shibboleth.SAML2NameIDGenerators">
> 
>         <ref bean="shibboleth.SAML2TransientGenerator" />
> 
>         <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
>         <ref bean="shibboleth.SAML2PersistentGenerator" />
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:omitQualifiers="true"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="#{ {'computedID'} }" />
>     </util:list>

This is nonsense, so remove all that and restore the default config
you'll find in the dist directory. Then *only* uncommonly the
<ref bean="shibboleth.SAML2PersistentGenerator" />
in there and you're done, as far as persistent NameIDs are concerned.

Why is it nonsense? Because you don't need to do any of that (pull in
an attribute called computedID) and because the format set is NOT that
of a persistent NameID but emailAddress. Makes no sense whatsoever.

> And in attribute-resolver.xml
> 
>     <AttributeDefinition id="eduPersonTargetedID" xsi:type="Simple">
>         <InputDataConnector ref="ComputedIDConnector" attributeNames="ComputedID" />
>         <AttributeEncoder xsi:type="SAML1String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" encodeType="false" />
>         <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" encodeType="false" />
>     </AttributeDefinition>

No, the type="Simple" creates an attribute with simple string values,
which is illegal for ePTID. This is what you want:

  <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
    <InputDataConnector ref="ComputedIDConnector" attributeNames="ComputedID" />
    <AttributeEncoder xsi:type="SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" encodeType="false" />
    <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" encodeType="false" />
  </AttributeDefinition>

> <DataConnector id="ComputedIDConnector" xsi:type="ComputedId"
>     generatedAttributeID="ComputedID"
>     salt="alllowercaseletters">
>    <InputDataConnector ref="myLDAP" attributeNames="eduPersonPrincipalName" />
> </DataConnector>

That's fine (except the salt doesn't match the one you used in
saml-nameid.properties, probably because you only sanities one out of
two before sending) but you could avoid repeating the values
completely by re-using those already set for proper NameIDs in
saml-nameid.properties:

  <DataConnector id="ComputedIDConnector" xsi:type="ComputedId" generatedAttributeID="ComputedID"
                 salt="%{idp.persistentId.salt}" algorithm="%{idp.persistentId.algorithm:SHA}"
                 encoding="BASE64">
      <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}" />
  </DataConnector>

Best,
-peter