eduPersonTargetedID not being sent as persistent

[Oulman,James F]

My notes from our integration with EverFi is that they want a persistent id in the format of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

We added a SAML2NameId Generator to saml-nameid.xml to send them EPPN

       <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:omitQualifiers="true"
             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
             p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
         <property name="activationCondition">
            <bean parent="shibboleth.Conditions.RelyingPartyId"
                  c:candidates="#{{
                    'https://fifoundry.net/saml/sp'
                  }}"/>
         </property>
       </bean>

And then configured the relying-party to force unspecified and disable encryption of NameIDs.

      <bean parent="RelyingPartyByName"
            c:relyingPartyIds="#{{
                                  'https://fifoundry.net/saml/sp'
                                }}" >
         <property name="profileConfigurations">
            <list>
               <bean parent="SAML2.SSO"
                     p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                     p:signResponses="true"
                     p:signAssertions="true"
                     p:encryptAssertions="true"
                     p:encryptNameIDs="false" />
               <bean parent="SAML2.ECP"
                     p:signResponses="true"
                     p:signAssertions="true"
                     p:encryptAssertions="true"
                     p:encryptNameIDs="false" />
            </list>
         </property>
      </bean>

-James

________________________________
From: users <users-bounces at shibboleth.net> on behalf of mhc-shib-admin <cswoods at mtholyoke.edu>
Sent: Wednesday, January 8, 2020 9:43 AM
To: users at shibboleth.net <users at shibboleth.net>
Subject: eduPersonTargetedID not being sent as persistent

[External Email]

Hi Folks-

I am setting up our IDP (v3.3) to work with Everfi. They are asking for a
persistent nameID so I am sending them eduPersonTargetedID. On examining the
SAML, I find this:

<saml2:Subject>
            <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                NameQualifier="https://urldefense.proofpoint.com/v2/url?u=https-3A__sso.mtholyoke.edu_idp_shibboleth&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=L7ZSO0pmrFS5YjcVKJ-lAV7uNO9bhwaXLvcLF7-znmM&e= "

SPNameQualifier="https://urldefense.proofpoint.com/v2/url?u=https-3A__admin.fifoundry.net_mount-5Fholyoke-5Fcollege_saml_sp&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=gJbUKDlwQqznGSaKjRAUJe6Fpkpnz_VbzTW9lFFN-kc&e= ">AAdzZWN....</saml2:NameID>
</saml2:Subject>

I didn't this was possible but as it, apparently is, can anyone suggest how
I can change it to persistent?

Thanks very much.



--
Sent from: https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.1660669.n2.nabble.com_Shibboleth-2DUsers-2Df1660767.html&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=arHFi2oZD-wi9y6RYRLHx9rImGhNlT1prglqq0t2RGE&e=
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=cDJS6M5Z1rWcRQMTYBJZvJMFSOB7BH8q-kG9xoS1oeA&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200108/b46370d4/attachment.html>