eduPersonTargetedID not being sent as persistent
Chris Woods
cswoods at mtholyoke.edu
Thu Jan 9 17:31:12 EST 2020
Thanks to everyone for their help and suggestions:
I've managed to produce the following:
<saml2:Attribute FriendlyName="eduPersonTargetedID"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
NameQualifier="
https://sso.mtholyoke.edu/idp/shibboleth"
SPNameQualifier="https://admin.fifoundry.saml.
../sp">w8L...</saml2:NameID>
</saml2:AttributeValue>
</saml2:Attribute>
Using the information on this page:
https://spaces.at.internet2.edu/display/ShibInstallFest/InCommon+Shibboleth+IdP+Training+-+NameID+Configuration
As well as the suggestions from James above.
Thing is we still can't log into Everfi. The only troubling piece of
information I have is from idp-process.log:
2020-01-09 16:54:49,199 - INFO [Shibboleth-Audit.SSO:275] -
20200109T215449Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|***|
https://admin.fifoundry.net/saml/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://sso.mtholyoke.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|***|cswoods|urn:oasis:names:tc:SAML:2.0:ac:classes:Password|eduPersonTargetedID,surname,givenName,email||***
If I understand the second from last field should show the value passed for
NameID and that field is empty. I'm a bit confused as to how the SAML
assertion could contain a NameID but somehow my own IDP thinks (or knows)
that we are passing nothing to the SP.
Thanks again for past and future help.
-Chris
-----------------------------------------------
Chris Woods, CISSP
He/him/his pronouns
Systems Administrator
Library, Information, and Technology Services
Mount Holyoke College
South Hadley, MA
413-538-3536
cswoods at mtholyoke.edu
-----------------------------------------------
On Wed, Jan 8, 2020 at 11:26 AM Oulman,James F <oulman at ufl.edu> wrote:
> My notes from our integration with EverFi is that they want a persistent
> id in the format of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
>
> We added a SAML2NameId Generator to saml-nameid.xml to send them EPPN
>
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> p:omitQualifiers="true"
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
> <property name="activationCondition">
> <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidates="#{{
> 'https://fifoundry.net/saml/sp'
> }}"/>
> </property>
> </bean>
>
> And then configured the relying-party to force unspecified and disable
> encryption of NameIDs.
>
> <bean parent="RelyingPartyByName"
> c:relyingPartyIds="#{{
> 'https://fifoundry.net/saml/sp'
> }}" >
> <property name="profileConfigurations">
> <list>
> <bean parent="SAML2.SSO"
>
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> p:signResponses="true"
> p:signAssertions="true"
> p:encryptAssertions="true"
> p:encryptNameIDs="false" />
> <bean parent="SAML2.ECP"
> p:signResponses="true"
> p:signAssertions="true"
> p:encryptAssertions="true"
> p:encryptNameIDs="false" />
> </list>
> </property>
> </bean>
>
> -James
>
> ------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of mhc-shib-admin <
> cswoods at mtholyoke.edu>
> *Sent:* Wednesday, January 8, 2020 9:43 AM
> *To:* users at shibboleth.net <users at shibboleth.net>
> *Subject:* eduPersonTargetedID not being sent as persistent
>
> [External Email]
>
> Hi Folks-
>
> I am setting up our IDP (v3.3) to work with Everfi. They are asking for a
> persistent nameID so I am sending them eduPersonTargetedID. On examining
> the
> SAML, I find this:
>
> <saml2:Subject>
> <saml2:NameID
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
> NameQualifier="
> https://urldefense.proofpoint.com/v2/url?u=https-3A__sso.mtholyoke.edu_idp_shibboleth&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=L7ZSO0pmrFS5YjcVKJ-lAV7uNO9bhwaXLvcLF7-znmM&e=
> "
>
> SPNameQualifier="
> https://urldefense.proofpoint.com/v2/url?u=https-3A__admin.fifoundry.net_mount-5Fholyoke-5Fcollege_saml_sp&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=gJbUKDlwQqznGSaKjRAUJe6Fpkpnz_VbzTW9lFFN-kc&e=
> ">AAdzZWN....</saml2:NameID>
> </saml2:Subject>
>
> I didn't this was possible but as it, apparently is, can anyone suggest how
> I can change it to persistent?
>
> Thanks very much.
>
>
>
> --
> Sent from:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.1660669.n2.nabble.com_Shibboleth-2DUsers-2Df1660767.html&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=arHFi2oZD-wi9y6RYRLHx9rImGhNlT1prglqq0t2RGE&e=
> --
> For Consortium Member technical support, see
> https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=_L7sACgIQaR0AZonCJxTrg&m=cDucy65-TFMRxFpieoaTxjzjI0PaSXLMUElCQxSXiFs&s=cDJS6M5Z1rWcRQMTYBJZvJMFSOB7BH8q-kG9xoS1oeA&e=
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200109/13b24f5f/attachment.html>
More information about the users
mailing list