Subject NameID format question

[Mathis, Bradley]

Thanks Peter,  I appreciate your input.

Brad Mathis
IT Systems Architect (Acting)
Infrastructure Services - Applications
Pima Community College
520.206.4826
bmathis at pima.edu









On Wed, Nov 13, 2019 at 1:09 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Mathis, Bradley <bmathis at pima.edu> [2019-11-13 20:06]:
> >    <resolver:AttributeDefinition xsi:type="ad:Template" id="user_id">
> >     <resolver:Dependency ref="myLDAP" />
> >     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> > nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
> >     <ad:SourceAttribute>mail</ad:SourceAttribute>
> > </resolver:AttributeDefinition>
>
> That's a nonsensical use of a "Template" attribute definition, it
> doesn't even have a Template element, cf.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverTemplateAttributeDefinition
>
> So the above at best is a weird way of writing a "Simple" attribute
> defintion: Pull in a source attribute and encode it into a NameID.
>
> > The part I don't understand is this I have at least 2 other attributes
> > definitions in the attribute-resolver.xml that do not work if I release
> > them instead,  such as the attribute "frshid"
> >
> > <resolver:AttributeDefinition xsi:type="ad:Template" id="frshid">
> >     <resolver:Dependency ref="myLDAP" />
> >     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> > nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
> >     <ad:SourceAttribute>mail</ad:SourceAttribute>
> > </resolver:AttributeDefinition>
>
> That's completely identical to the IDP in every regard with the
> exception of the purely internally relevant "id".
> So whatever releasing "user_id" in the filter achives must also be
> achived by releasing "frshid" in the filter.
>
> > Here a snippet of the Subject from a SAML trace when it works releasing
> the
> > attribute "user_id"
> >
> > <saml2:Subject>
> > <saml2:NameID
> Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
> [...]
> > Here's a snippet of the Subject from a SAML trace when it doesn't work
> > releasing the attribute "frshid".
> >
> > <saml2:Subject>
> > <saml2:NameID
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>
> I have no explanation for that since both seem to be for the SAML SP,
> i.e., any rules in your IDP based on metadata or relying-party
> overrides would have to apply in both cases (as there's only one
> entityID).
>
> > Why does it only work when I use the attribute "user_id"?  I'm glad I was
> > able to make it work but not happy that I don't understand why.    I will
> > be happy to answer any questions for further clarification if
> > needed.
>
> It makes no sense that it would work any differently given the config
> snippets provided above, the definitions for "user_id" and "frshid"
> are identical (as any diff tool would tell you) besides the id.
> Maybe you haven't released frshid in the filter.
>
> Either way, the software you're messing with has been finally and
> fully obsoleted 3.5 years ago[1], and we're dealing with security
> software here. So you're playing with fire every minute you spend on
> something other than replacing that server with one based on a current
> release.
>
> Best regards,
> -peter
>
> [1] http://shibboleth.net/pipermail/announce/2015-May/000112.html
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20191113/7f282f2e/attachment.html>