custom nameid formats and metadata-driven config

[Les LaCroix]

There is no NameIDPolicy in the SAML requests from this service.  The
vendor-generated metadata file doesn't contain any NameIDFormat, but it's
not expected to work out of the box either, as it doesn't include an
entityID.  They don't care what the nameid-format specifier is.  They just
need the user's username returned as the saml2:Subject.

I added
"<md:NameIDFormat>urn:oid:0.9.2342.19200300.100.1.1</md:NameIDFormat>" in
the SP's metadata, but my understanding now is that alone is insufficient
because of the nameIDFormatPrecedence that we added to our default relying
party configuration years ago.

Based on
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration#NameID-Format-Selection,
I thought that adding the following to the metadata would trigger the
custom format.  It does not.

      <mdattr:EntityAttributes>
         <saml:Attribute Name="
http://shibboleth.net/ns/profiles/nameIDFormatPrecedence"
               NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<saml:AttributeValue>urn:oid:0.9.2342.19200300.100.1.1</saml:AttributeValue>
         </saml:Attribute>
      </mdattr:EntityAttributes>

I do, however, trigger the custom format if I instead add the following to
my relying-party.xml.

        <bean parent="RelyingPartyByName"
                    c:relyingPartyIds="#{{'http://sp.example.org/'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.MDDriven"

p:nameIDFormatPrecedence="#{{'urn:oid:0.9.2342.19200300.100.1.1'}}" />
                </list>
            </property>
        </bean>

I am using an entity attribute for this SP to set encryptAssertions=false
(not shown above), and I'm really hoping to figure out how to also override
nameIDFormatPrecedence with an entity attribute too.

Thanks, -Les


<http://www.carleton.edu/>

*Les LaCroix '79*

Strategic Technologist

Information Technology Services

t: (507) 222-5455


On Thu, Aug 4, 2022 at 9:05 AM Mak, Steven <makst at upenn.edu> wrote:

> Les,
>
>
>
> What is the service sending for a NameIDPolicy in the SAML request? If
> they're sending something that is not what their devs have stated they want
> (which is often the case), that could explain why the SP metadata route
> didn't work.
>
>
>
> - Steve
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220804/bdac83fc/attachment.htm>