IDP 4.1.5 Nameid

[Mathew, Sunil]

Thanks Scott.

I followed the example here for conflicting requirements:  https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631672/CustomNameIDGenerationConfiguration#Dealing-with-Conflicting-Requirements

saml-nameid.xml:

        <!-- Canvas -->

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

            p:omitQualifiers="true"

            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

            p:attributeSourceIds="#{ {'canvas_name_id'} }"

            p:activationCondition-ref="CanvasCondition" />

services.xml:
    <!-- Canvas -->
    <bean id="CanvasCondition" parent="shibboleth.Conditions.OR">
        <constructor-arg>
            <list>
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="http://hbs-dev.instructure.com/saml2" />
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="http://hbs-int.instructure.com/saml2" />
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="http://hbs.instructure.com/saml2" />
            </list>
        </constructor-arg>
    </bean>


What is the purpose of NameIDFormatFilter (https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631650/NameIDFormatFilter)?

Sunil

From: Cantor, Scott <cantor.2 at osu.edu>
Date: Friday, March 18, 2022 at 1:32 PM
To: Mathew, Sunil <smathew at hbs.edu>, Shib Users <users at shibboleth.net>
Subject: Re: IDP 4.1.5 Nameid
On 3/18/22, 12:57 PM, "Mathew, Sunil" <smathew at hbs.edu> wrote:

>    Does that mean if I have to define nameids for each SP, I will have to configure separate
> SAML2AttributeSourcedGenerator in saml-nameid.xml?

No, because a NameID is based on its Format, not the SP. You should never allow an SP to violate that rule.

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220318/7550e6f6/attachment.htm>