mix different NameIDs for different SPs

[Pascal Rigaux]

Hi,

Since many SPs do not really care about the "format" of the NameID, we  
have multiple _local_ formats in saml-nameid.xml :

    <util:list id="shibboleth.SAML2NameIDGenerators">

         ...

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:omitQualifiers="true"
             p:format="urn:mace:cru.fr:federation:univ-paris1.fr:uid"
             p:attributeSourceIds="#{ {'uid'} }">
         </bean>

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:omitQualifiers="true"
             p:format="urn:mace:cru.fr:federation:univ-paris1.fr:eppn"
             p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
         </bean>

     </util:list>

And we force them in relying-party.xml, example:

         <bean parent="RelyingPartyByName"  
c:relyingPartyIds="https://pantheonsorbonne.zoom.us">
           <property name="profileConfigurations">
             <list>
               <bean parent="SAML2.SSO"  
p:nameIDFormatPrecedence="urn:mace:cru.fr:federation:univ-paris1.fr:eppn"  
/>
             </list>
           </property>
         </bean>

Tested with zoom, jamfcloud, juniper webvpn.


You can also have different nameid for a format using  
"activationCondition" (as you mentioned)
We use this for MicrosoftOnline to override the default "persistent"  
nameid format:

   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
        p:attributeSourceIds="#{ {'ImmutableID'} }">
             <property name="activationCondition">
                 <bean parent="shibboleth.Conditions.RelyingPartyId"  
c:candidates="#{{'urn:federation:MicrosoftOnline'}}" />
             </property>
         </bean>

and
         <bean parent="RelyingPartyByName"  
c:relyingPartyIds="urn:federation:MicrosoftOnline">
           <property name="profileConfigurations">
             <list>
               <bean parent="SAML2.SSO"  
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" p:encryptAssertions="false"  
/>
             </list>
           </property>
         </bean>


jehan Procaccia tem-tsp <jehan.procaccia at tem-tsp.eu> a écrit :

> hello
>
> based on  
> https://wiki.shibboleth.net/confluence/display/IDP4/NameIDGenerationConfiguration
>
> I did manage to create a persistent nameID based on mail attribute  
> as required by specific SPs [1]
>
> but there are other SPs that needs also a persistent nameID, this  
> time based on eppn !
>
> I can I mix those 2 (and perhaps one day 3 or more ... ) attribute  
> based persistent NameIDs for differents SPs [2] ?
>
> in /saml-nameid.properties/ there's only on variable :  
> ////idp.persistentId.sourceAttribute//
>
> Thanks .
>
> [1]
>
> /saml-nameid.properties//
> /
>
> /idp.persistentId.useUnfilteredAttributes = true//
> //idp.persistentId.sourceAttribute = mail//
> //idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator//
> //
> /
>
> /saml-nameid.xml//
> /
>
> /  <ref bean="shibboleth.SAML2TransientGenerator" />//
> //
> //        <!-- Uncommenting this bean requires configuration in  
> saml-nameid.properties. -->//
> //        <!-- Jehan -->//
> //        <ref bean="shibboleth.SAML2PersistentGenerator" />//
> //        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"//
> //            p:omitQualifiers="true"//
> //p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"//
> //*  p:attributeSourceIds="#{ {'mail'} }" >*//
> //                <property name="activationCondition">//
> //                        <!-- docusign multiple c:candidates -->//
> //                        <bean  
> parent="shibboleth.Conditions.RelyingPartyId"//
> //c:candidates="#{{'https://account.docusign.com/organizations/bf2a2a29-SECRET/saml2', 'https://account-d.docusign.com/organizations/bd30f5b2-SECRET/saml2'}}"  
> />//
> //                -->//
> //                </property>//
> //        </bean>//
> //    </util:list>//
> /
>
> [2] /
> /
>
> Here in /saml-nameid.xml / I guess I could add another bean based on
>
> /*p:attributeSourceIds="#{ {'eppn'} }" >
> */
>
> and appropriate  c:candidates= entityIDs ...



-- 
Pascal Rigaux