Persistent ID instead of Transient Name ID

[Mak, Steven]

You want to refer to this: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631673/PersistentNameIDGenerationConfiguration

Specifically, the ComputedIDs or StoredIDs depending on your stack.

This vendor is actually asking for the protocol-compliant persistent format NameID, which is refreshing.

Regarding the SP metadata, you MAY have to delete the "unspecified" line. My IdP tends to resolve to whatever it wants when "unspecified" is in the SP metadata. The listed NameIDFormat list is just a preference list from the SP, most to least preferred. Your IdP will use that list to compare it to the NameIDs available internally to choose which one to actually send.

- Steve

From: users <users-bounces at shibboleth.net> on behalf of Melvin Lasky via users <users at shibboleth.net>
Date: Wednesday, January 11, 2023 at 10:51 AM
To: Shib Users <users at shibboleth.net>
Cc: Melvin Lasky <melvin.lasky at manhattan.edu>
Subject: Persistent ID instead of Transient Name ID
Hey everyone,
In all my time of using shibboleth, I’ve never had a vendor say they want 0 attributes. But, alas, that’s what I’m faced with this week. However, they do want a persistent ID that’s non-identifiable to a person? I’m not even sure how this would be possible, hence why I’m here asking. LOL

Any help will be greatly appreciated…

This is what they asked for: "Do you have the option to send an opaque, unique, and unchanging user identifier? "

Also in their metadata they have:

    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>

    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

Which I don’t understand, LOL.

Thanks

Mel

Melvin Lasky
Associate Director of Enterprise Architecture
[cid:30040C3B-58F3-41D0-91CF-B57E6B6E2FB7 at manhattan.edu]



Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu
www.manhattan.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/ceffcb6d/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 1.jpeg
Type: image/jpeg
Size: 3547 bytes
Desc: 1.jpeg
URL: <http://shibboleth.net/pipermail/users/attachments/20230111/ceffcb6d/attachment.jpeg>