Persistent ID instead of Transient Name ID

[Dave Perry]

Hi

If it helps, we send eduPersonTargetedID as a 'persistent' attribute.
It's computed in attribute-resolver.xml, based on the username and a salt - so it's consistent every time that same username logs in.

Config lines follow (add both these chunks in with your other definitions):

      <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
            <InputDataConnector ref="computedID" attributeNames="computedID" />
            <AttributeEncoder xsi:type="SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
            <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
      </AttributeDefinition>

      <DataConnector xsi:type="ComputedId"
                                          id="computedID"
                                          generatedAttributeID="computedID"
                                          salt="yourSaltGoesHere">    
            <InputDataConnector ref="myLDAP" attributeNames="objectGUID" />
      </DataConnector>

This assumes myLDAP is connecting to on-prem Active Directory.


HTH
Dave
_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
email at yorksj.ac.uk<mailto:email at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk>

[cid:da903abc-ab89-4064-8aa9-f648371f5fbe]

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Melvin Lasky via users <users at shibboleth.net>
Sent: 11 January 2023 15:50
To: Shib Users <users at shibboleth.net>
Cc: Melvin Lasky <melvin.lasky at manhattan.edu>
Subject: Persistent ID instead of Transient Name ID

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.

Hey everyone,
In all my time of using shibboleth, I’ve never had a vendor say they want 0 attributes. But, alas, that’s what I’m faced with this week. However, they do want a persistent ID that’s non-identifiable to a person? I’m not even sure how this would be possible, hence why I’m here asking. LOL

Any help will be greatly appreciated…

This is what they asked for: "Do you have the option to send an opaque, unique, and unchanging user identifier? "

Also in their metadata they have:

    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

Which I don’t understand, LOL.

Thanks

Mel

Melvin Lasky
Associate Director of Enterprise Architecture

[1.jpeg]



Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu
www.manhattan.edu


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/cf06e0f8/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 1.jpeg
Type: image/jpeg
Size: 3547 bytes
Desc: 1.jpeg
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/cf06e0f8/attachment.jpeg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-z4p0wog0.png
Type: image/png
Size: 12155 bytes
Desc: Outlook-z4p0wog0.png
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/cf06e0f8/attachment.png>