mix different NameIDs for different SPs

[Jehan PROCACCIA]

thanks for the example pascal, I did not realized that there we could set the SP activateCondition (RelyingPartyByName) either in saml-nameid.xml and relying-party.xml

To Nate, we do have SP vendors that don't give us the choice and ask a specific NameID format (usually persistent) and based on a specific attribute (mail) 
the thing is that for other SPs we don't want that on the remote SP the account be created based on an email address that is subject to change in the futur
indeed, usually they create on the fly at 1st connexion the account based on the NamedID value . 
So we'd like to enable NameID value based on eppn or other attribute depending if we have control or not on the SP . 

For example I have a local hosted "RocketChat" SP which I have control of, but still struggle on the username format created witch keeps beeing based on mail
RocketChat params: 
-Identifier Format => urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
-NameID Policy Template => <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Format="__identifierFormat__" AllowCreate="true"></samlp:NameIDPolicy>
- __identifierFormat__ beeing The value of the Identifier Format setting.

I don't know if I need to force on IDP for that SP the NamedID attribute to Eppn , or change on the SP side to use an SAML attribute (eppn)  instead of the NAmeID value .

----- Mail original -----
De: "Pascal Rigaux" <Pascal.Rigaux at univ-paris1.fr>
À: "users" <users at shibboleth.net>
Envoyé: Vendredi 19 Mars 2021 19:41:12
Objet: Re: mix different NameIDs for different SPs

Hi,

Since many SPs do not really care about the "format" of the NameID, we  
have multiple _local_ formats in saml-nameid.xml :

    <util:list id="shibboleth.SAML2NameIDGenerators">

         ...

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:omitQualifiers="true"
             p:format="urn:mace:cru.fr:federation:univ-paris1.fr:uid"
             p:attributeSourceIds="#{ {'uid'} }">
         </bean>

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:omitQualifiers="true"
             p:format="urn:mace:cru.fr:federation:univ-paris1.fr:eppn"
             p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
         </bean>

     </util:list>

And we force them in relying-party.xml, example:

         <bean parent="RelyingPartyByName"  
c:relyingPartyIds="https://pantheonsorbonne.zoom.us">
           <property name="profileConfigurations">
             <list>
               <bean parent="SAML2.SSO"  
p:nameIDFormatPrecedence="urn:mace:cru.fr:federation:univ-paris1.fr:eppn"  
/>
             </list>
           </property>
         </bean>

Tested with zoom, jamfcloud, juniper webvpn.


You can also have different nameid for a format using  
"activationCondition" (as you mentioned)
We use this for MicrosoftOnline to override the default "persistent"  
nameid format:

   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
        p:attributeSourceIds="#{ {'ImmutableID'} }">
             <property name="activationCondition">
                 <bean parent="shibboleth.Conditions.RelyingPartyId"  
c:candidates="#{{'urn:federation:MicrosoftOnline'}}" />
             </property>
         </bean>

and
         <bean parent="RelyingPartyByName"  
c:relyingPartyIds="urn:federation:MicrosoftOnline">
           <property name="profileConfigurations">
             <list>
               <bean parent="SAML2.SSO"  
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" p:encryptAssertions="false"  
/>
             </list>
           </property>
         </bean>


jehan Procaccia tem-tsp <jehan.procaccia at tem-tsp.eu> a écrit :

> hello
>
> based on  
> https://wiki.shibboleth.net/confluence/display/IDP4/NameIDGenerationConfiguration
>
> I did manage to create a persistent nameID based on mail attribute  
> as required by specific SPs [1]
>
> but there are other SPs that needs also a persistent nameID, this  
> time based on eppn !
>
> I can I mix those 2 (and perhaps one day 3 or more ... ) attribute  
> based persistent NameIDs for differents SPs [2] ?
>
> in /saml-nameid.properties/ there's only on variable :  
> ////idp.persistentId.sourceAttribute//
>
> Thanks .
>
> [1]
>
> /saml-nameid.properties//
> /
>
> /idp.persistentId.useUnfilteredAttributes = true//
> //idp.persistentId.sourceAttribute = mail//
> //idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator//
> //
> /
>
> /saml-nameid.xml//
> /
>
> /  <ref bean="shibboleth.SAML2TransientGenerator" />//
> //
> //        <!-- Uncommenting this bean requires configuration in  
> saml-nameid.properties. -->//
> //        <!-- Jehan -->//
> //        <ref bean="shibboleth.SAML2PersistentGenerator" />//
> //        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"//
> //            p:omitQualifiers="true"//
> //p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"//
> //*  p:attributeSourceIds="#{ {'mail'} }" >*//
> //                <property name="activationCondition">//
> //                        <!-- docusign multiple c:candidates -->//
> //                        <bean  
> parent="shibboleth.Conditions.RelyingPartyId"//
> //c:candidates="#{{'https://account.docusign.com/organizations/bf2a2a29-SECRET/saml2', 'https://account-d.docusign.com/organizations/bd30f5b2-SECRET/saml2'}}"  
> />//
> //                -->//
> //                </property>//
> //        </bean>//
> //    </util:list>//
> /
>
> [2] /
> /
>
> Here in /saml-nameid.xml / I guess I could add another bean based on
>
> /*p:attributeSourceIds="#{ {'eppn'} }" >
> */
>
> and appropriate  c:candidates= entityIDs ...



-- 
Pascal Rigaux

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net