How to use NameID source Attribute as-is 1:1, without hashing?

[Käfer Thomas]

Hello everyone!

I'm currently trying to setup an IDP 4.1.5 server to replace an IDP 2.3.8 one that we use to authenticate users to Microsoft services.

The stumbling stone I've been trying to overcome for the last few days is this question:

How do I get an existing attribute (loaded through a DataConnector defined in attribute-resolver.xml) to be used as-is 1:1 (not as a source attribute for a hash function) as the persistent nameid that Microsoft checks for in my IDPs auth response?

On the IDP 2.3.8 this was all I needed:

    <resolver:AttributeDefinition id="ImmutableID" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="ImmutableID">
      <resolver:Dependency ref="myDataConnector" />
      <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
    </resolver:AttributeDefinition>

But as this page tells us:
https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2524447292/DeprecatedIdPV4
> The encoder type "SAML2StringNameID" has been depricated in favor of NameID Generation service.

Sadly, both the supported strategies don't seem to be able to do what I need:
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631673/PersistentNameIDGenerationConfiguration

Is there any way to get the functionality described above with just configuration, or do I need to write Java code, maybe a customized version of shibboleth.SAML2PersistentGenerator, shibboleth.StoredPersistentIdGenerator, or some other class?

Thank you,
kind regards,
Thomas Käfer

Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220322/213ac267/attachment.htm>