<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
While playing with Shibboleth IdP v.3 I found some problems with
persistent identifier generation.
<br>
I describe things in detail below, but the main issue is that both
with
ComputedPersistentIdGeneraton and StoredPersistentIdGenerator I seem
to
be forced additionally release idp.persistentId.sourceAttribute,
which
is something I definitely do not want to do.
<br>
<br>
So the details:
<br>
The default strategy (shibboleth.ComputedPersistentIdGeneraton)
seems to
work as expected but what worries me - an attribute set as
idp.persistentId.sourceAttribute has to be <br>
released by a policy
otherwise it cannot be used as a key for the subject and NameID
generation fails.<br>
In consequence this attribute is sent to an SP.
<br>
I observe a similar problem with the persistent store.
<br>
I followed this instruction
<a class="moz-txt-link-freetext"
href="https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-PersistentIdentifierGeneration">https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-PersistentIdentifierGeneration</a>
<br>
<br>
<i>Using this strategy requires changing the
idp.persistentId.strategy
property to "shibboleth.StoredPersistentIdGenerator" and setting
the
idp.persistentId.store property to the name </i><i><br>
</i><i>of a bean you must define.
You can place it in saml-nameid.xml if you like. </i><i><br>
</i><i>The main content of
that bean is a reference to a JDBC DataSource object.
</i><br>
<br>
First of all I suppose that there is a mistake in the documentation
because setting idp.persistentId.strategy seems not to be
recognized, so
I set:
idp.persistentId.generator=shibboleth.StoredPersistentIdGenerator
<br>
idp.persistentId.store=UMKStore
<br>
and I add UMKStore bean.
<br>
It works and even when persistentId is changed in the store, the new
value is added to saml2:Subject.
<br>
The problem is that while using
shibboleth.StoredPersistentIdGenerator I
still have to declare
idp.persistentId.sourceAttribute and idp.persistentId.salt
and the worst - an attribute set <br>
as idp.persistentId.sourceAttribute
has to be released by a policy.
<br>
According to the log when profile AddNameIDToSubjects is proceeded
and
request specified
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
format first PersistentSAML2NameIDGenerator is used and when
attribute
sources did not produce a usable source identifier then an error
event
is sent (InvalidNameIDPolicy).
<br>
When attribute sources are provided, first
PersistentSAML2NameIDGenerator generates NameID from an attribute,
then
StoredPersistentIdGenerationStrategy locates stored ID <br>
which is sent as
NameID.
Reverting this process and skipping generation from an attribute
when
StoredPersistentIdGenerationStrategy succeeded would be better.
<br>
Can I achieve it in some way?<br>
<br>
Maja<br>
<br>
<pre class="moz-signature" cols="72">--
Maja Gorecka-Wolniewicz <a class="moz-txt-link-abbreviated" href="mailto:mgw@umk.pl">mgw@umk.pl</a>
Uczelniane Centrum Information & Communication
Informatyczne Technology Centre
Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University
Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland
tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574</pre>
</body>
</html>