<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap:break-word"><span style="font-family:Calibri, Arial, Helvetica, sans-serif;font-size:11pt;color:black">I had to do a few of these recently, myself. I know you're working with a vendor, but I personally wouldn't represent the value of this eppn-based nameid as transient.<br><br>-Charles<br><br><span style="color:black">
-----Original Message-----
<br><b>From:</b> David Bantz [dabantz@alaska.edu]<br><b>Received:</b> Friday, 29 Aug 2014, 6:26PM<br><b>To:</b> Shib Users [users@shibboleth.net]<br><b>Subject:</b> Re: scoped NameID SAML subject<br/><br/></span></span><br>
To tie up this thread, I was able to “build” and attribute syntactically identical to ePPN
<div>that is released as the domain-qualified NameID in the Subject of the SAML assertion using</div>
<div>the definition below. I’m not proud of it, but it seems to do the job.</div>
<div><br>
</div>
<div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(184,184,184)">
<!— Create NameID like ePPN for the SAML Subject --></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(255,147,0)">
<span style="color:#091480"><resolver:AttributeDefinition </span><span style="color:#4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:resolver:ad"<span style="color:#091480"> </span></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(255,147,0)">
<span style="color:#091480"> </span><span style="color:#4b5a7d">xmlns:xsi=</span>"<a href="http://www.w3.org/2001/XMLSchema-instance" target="_BLANK">http://www.w3.org/2001/XMLSchema-instance</a>"<span style="color:#091480"> </span></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(255,147,0)">
<span style="color:#091480"> </span><span style="color:#4b5a7d">xmlns:resolver=</span>"urn:mace:shibboleth:2.0:resolver"<span style="color:#091480"> </span></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<span style="color:#098021">id=</span><span style="color:#ff9300">"oktanameid"</span>
<span style="color:#098021">xsi:type=</span><span style="color:#ff9300">"Script"</span> </div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<span style="color:#098021">sourceAttributeID=</span><span style="color:#ff9300">"UASystemID"</span>></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<span style="color:#323333"><span class="Apple-tab-span" style="white-space:pre"></span></span><resolver:Dependency
<span style="color:#098021">ref=</span><span style="color:#ff9300">"myLDAP"</span>/></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(255,147,0)">
<span style="color:#323333"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color:#091480"><resolver:AttributeEncoder
</span><span style="color:#4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"<span style="color:#091480"> </span></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<span class="Apple-tab-span" style="white-space:pre"></span>
<span style="color:#098021">xsi:type=</span><span style="color:#ff9300">"SAML2StringNameID"</span> </div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(255,147,0)">
<span style="color:#091480"><span class="Apple-tab-span" style="white-space:pre"></span>
</span><span style="color:#098021">nameFormat=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<span style="color:#091480">/></span></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(75,90,125)">
<span style="color:#323333"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color:#091480"><Script></span><![CDATA[</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51)">
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51)">
importPackage(Packages.org.slf4j);</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51); min-height:16px">
<br>
</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51)">
if (null == oktanameid) {oktanameid = new BasicAttribute("oktanameid");}</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51)">
oktausername = UASystemID.getValues().get(0);</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51)">
oktanameid.getValues().add(oktausername + "@<a href="http://alaska.edu" target="_BLANK">alaska.edu</a>");</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(50,51,51); min-height:16px">
<br>
</div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<span style="color:#323333"> </span><span style="color:#4b5a7d">]]></span></Script></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
</resolver:AttributeDefinition></div>
<div style="margin:0px; font-size:13px; font-family:'Lucida Sans'; color:rgb(9,20,128)">
<br>
</div>
<div>
<div>On Thu, 28 Aug 2014, at 13:53 , Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">On 8/28/14, 5:48 PM, "David Bantz" <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br>
<br>
</blockquote>
<div></div>
<blockquote type="cite">
<div></div>
</blockquote>
<blockquote type="cite">
<blockquote type="cite">
<div>Attempting to build a NameID in the SAML subject to meet a vendor requirement.</div>
<div>The following uses and inserts the right identifier, but despite being based on ePPN, </div>
<div>appears in the SAML assertion subject un-scoped: If ePPN is <a href="mailto:george@my.domain">george@my.domain</a>, this </div>
<div>uses the NameID of george in subject portion of the SAML. To meet vendor requirement,</div>
<div>I need the scoped value <a href="mailto:george@my.domaim">george@my.domaim</a>. Is there a simple way to do that?</div>
<div><br>
</div>
<div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(79,45,222); background-color:rgb(255,250,194)">
<!-- Okta requires something like ePPN in the SAML Subject --></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,182,195); background-color:rgb(255,250,194)">
<<span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span>AttributeDefinition</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">id</span><span style="color:rgb(0,0,0)">=</span>"oktanameid"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xsi</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,184,32)">type</span><span style="color:rgb(0,0,0)">=</span>"Simple"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xmlns</span><span style="color:rgb(0,0,0)">=</span>"urn:mace:shibboleth:2.0:resolver:ad"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">sourceAttributeID</span><span style="color:rgb(0,0,0)">=</span>"eduPersonPrincipalName"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xmlns</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,184,32)">xsi</span><span style="color:rgb(0,0,0)">=</span>"<a href="http://www.w3.org/2001/XMLSchema-instance" target="_BLANK">http://www.w3.org/2001/XMLSchema-instance</a>"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xmlns</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,184,32)">resolver</span><span style="color:rgb(0,0,0)">=</span>"urn:mace:shibboleth:2.0:resolver"<span style="color:rgb(44,182,195)">></span></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,182,195); background-color:rgb(255,250,194)">
<span style="color:rgb(0,0,0)"> </span><<span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span>Dependency <span style="color:rgb(44,184,32)">ref</span><span style="color:rgb(0,0,0)">=</span><span style="color:rgb(191,52,29)">"myLDAP"</span> /></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(0,0,0)"> </span><span style="color:rgb(44,182,195)"><</span><span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,182,195)">Dependency </span><span style="color:rgb(44,184,32)">ref</span><span style="color:rgb(0,0,0)">=</span>"eduPersonPrincipalName"<span style="color:rgb(44,182,195)"> /></span></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,182,195); background-color:rgb(255,250,194)">
<span style="color:rgb(0,0,0)"> </span><<span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span>AttributeEncoder</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xsi</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,184,32)">type</span><span style="color:rgb(0,0,0)">=</span>"SAML2StringNameID"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xmlns</span><span style="color:rgb(0,0,0)">=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">nameFormat</span><span style="color:rgb(0,0,0)">=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<span style="color:rgb(44,182,195)"> /></span></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,182,195); background-color:rgb(255,250,194)">
<span style="color:rgb(0,0,0)"> </span><<span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span>AttributeEncoder</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xsi</span><span style="color:rgb(79,45,222)">:</span><span style="color:rgb(44,184,32)">type</span><span style="color:rgb(0,0,0)">=</span>"SAML2String"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">xmlns</span><span style="color:rgb(0,0,0)">=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(191,52,29); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span><span style="color:rgb(44,184,32)">name</span><span style="color:rgb(0,0,0)">=</span>"urn:oid:1.3.6.1.4.1.5923.1.1.1.6"</div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,184,32); background-color:rgb(255,250,194)">
<span style="color:rgb(44,182,195)"> </span>friendlyName<span style="color:rgb(0,0,0)">=</span><span style="color:rgb(191,52,29)">"username"</span><span style="color:rgb(44,182,195)"> /></span></div>
<div style="margin:0px; font-size:11px; font-family:Monaco; color:rgb(44,182,195); background-color:rgb(255,250,194)">
<span style="color:rgb(0,0,0)"> </span></<span style="color:rgb(208,54,207)">resolver</span><span style="color:rgb(79,45,222)">:</span>AttributeDefinition></div>
</div>
</blockquote>
</blockquote>
<div><br>
</div>
<blockquote type="cite"><br>
Not simple, you'd have to get an attribute defined that's string-valued<br>
with both parts included, and attach the encoder to that. Basically what<br>
you'd do with mail.<br>
<br>
I fixed this in v3 when the new portion of the IdP is used to generate<br>
NameIDs instead of the resolver.<br>
<br>
-- Scott<br>
<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
</div>
</body>
</html>