Proxying a Persistent NameID

[Gianluca Amato]

Hello,

I manage a Shibboleth 5.1 server which proxies another Shibboleth IdP (not
sure about its version). Up to now, all the service providers connected to
the proxy were using Transient NameIDs, but now I need to connect to a
service provider that requires a Persistent NameID.

My first idea was to ask the proxied IdP for the Persistent NameID and pass
it over to the service provider. However, this seems very hard to
implement, and requires a lot of work. At the moment, I have changed my
configuration in order to:

   - ask the proxied IdP for a permanent NameID
   - use a  SubjectDerivedAttribute and a scripted function to extract the
   NameID from the Subject and turn it into an attribute
   - generate a permanente NameID from this attribute value by using a
   SAML2AttributeSourcedGenerator with
   format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"

It works but has several flaws (most importantly, the SPNameQualifier of
the NameID that the proxied IdP sends me is the Entity ID of the proxy
instead of the Entity ID of the service provider).

Since proxying the original NameID seems quite convoluted to implement, I
wonder if it is something I should not do, and just generate the Persistent
NameID on the proxy, even if it is different from the one generated in the
proxied IdP.

Are there any best practices on this topic ?

Thanks a lot.

Best regards.
--gianluca amato
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241023/ecb88816/attachment.htm>