Subject NameID format question

[Peter Schober]

* Mathis, Bradley <bmathis at pima.edu> [2019-11-13 20:06]:
>    <resolver:AttributeDefinition xsi:type="ad:Template" id="user_id">
>     <resolver:Dependency ref="myLDAP" />
>     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>     <ad:SourceAttribute>mail</ad:SourceAttribute>
> </resolver:AttributeDefinition>

That's a nonsensical use of a "Template" attribute definition, it
doesn't even have a Template element, cf.
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverTemplateAttributeDefinition

So the above at best is a weird way of writing a "Simple" attribute
defintion: Pull in a source attribute and encode it into a NameID.

> The part I don't understand is this I have at least 2 other attributes
> definitions in the attribute-resolver.xml that do not work if I release
> them instead,  such as the attribute "frshid"
> 
> <resolver:AttributeDefinition xsi:type="ad:Template" id="frshid">
>     <resolver:Dependency ref="myLDAP" />
>     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
>     <ad:SourceAttribute>mail</ad:SourceAttribute>
> </resolver:AttributeDefinition>

That's completely identical to the IDP in every regard with the
exception of the purely internally relevant "id".
So whatever releasing "user_id" in the filter achives must also be
achived by releasing "frshid" in the filter.

> Here a snippet of the Subject from a SAML trace when it works releasing the
> attribute "user_id"
> 
> <saml2:Subject>
> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
[...]
> Here's a snippet of the Subject from a SAML trace when it doesn't work
> releasing the attribute "frshid".
> 
> <saml2:Subject>
> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

I have no explanation for that since both seem to be for the SAML SP,
i.e., any rules in your IDP based on metadata or relying-party
overrides would have to apply in both cases (as there's only one
entityID).

> Why does it only work when I use the attribute "user_id"?  I'm glad I was
> able to make it work but not happy that I don't understand why.    I will
> be happy to answer any questions for further clarification if
> needed.

It makes no sense that it would work any differently given the config
snippets provided above, the definitions for "user_id" and "frshid"
are identical (as any diff tool would tell you) besides the id.
Maybe you haven't released frshid in the filter.

Either way, the software you're messing with has been finally and
fully obsoleted 3.5 years ago[1], and we're dealing with security
software here. So you're playing with fire every minute you spend on
something other than replacing that server with one based on a current
release.

Best regards,
-peter

[1] http://shibboleth.net/pipermail/announce/2015-May/000112.html