<div dir="ltr">don't you need to add clause to indicate that nameID is used for specific SP(s)? like<div><br></div><div>







<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1">                       <property name="activationCondition"><br></span><span class="gmail-s1">                                <bean parent="shibboleth.Conditions.RelyingPartyId"<br></span><span class="gmail-s1">                                                c:candidates="#{ {</span><span class="gmail-s1"><br></span><span class="gmail-s1">                                                '<a href="https://very.special.sp.com">https://very.special.sp.com</a>'<br></span><span class="gmail-s1">                                                 } }" /><br></span><span class="gmail-s1">                        </property></span></blockquote>













</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jan 31, 2017 at 10:41 AM, Sheldon, Nathan I <span dir="ltr"><<a href="mailto:Nathan.Sheldon@ucsf.edu" target="_blank">Nathan.Sheldon@ucsf.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<div style="word-wrap:break-word">
Hi folks.
<div><br>
</div>
<div>Is it possible to configure the SAML2TransientGenerator to send an attribute sourced value (similar to a persistent ID or other non-transient NameID)?  If so, is there documentation on how this might be done?</div>
<div><br>
</div>
<div>Why you might ask?  A (well known database) vendor’s application already integrated with our soon-to-be upgraded IdP version 2.3.8 environment requires a NameID in the SAML response with a format defined as "urn:oasis:names:tc:SAML:2.0:<wbr>nameid-format:transient”
 but whose actual value is a user ID which they use as their primary key for the application.  It was successfully integrated (by someone before my tenure) with our IdP 2.3.8 environment by adding</div>
<div>——</div>
<div>    <resolver:AttributeEncoder <wbr>xsi:type="enc:<wbr>SAML2StringNameID"<br>
        nameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:nameid-format:<wbr>transient" /></div>
<div>——</div>
<div>to the attribute definition in the attribute-resolver.xml configuration.</div>
<div><br>
</div>
<div>I’ve informed the application owner that this misuse of the NameID format will need to be changed, but it’s rather unlikely they’ll be able to get the vendor to modify their code before we need to put IdP 3.3 into production.</div>
<div><br>
</div>
<div>I’ve tried adding the below bean to the SAML2NameIDGenerators list in the conf/saml-nameid.xml configuration.</div>
<div>——</div>
<div>        <bean parent="shibboleth.<wbr>SAML2AttributeSourcedGenerator<wbr>"<br>
            p:format="urn:oasis:names:<wbr>tc:SAML:2.0:nameid-format:<wbr>transient"<br>
            p:attributeSourceIds="#{ {<br>
                'uidNameID'<br>
            } }"><br>
        </bean><br>
——</div>
<div>but the NameID value produced in the SAML response still contains the generated transient ID string rather than the attribute value.</div>
<div><br>
</div>
<div>The “uidNameID” attribute is defined in the attribute-resolver.xml and the SAML response includes that attribute and correct value.</div>
<div><br>
</div>
<div>
<div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<div>----</div>
<div>Nathan Sheldon</div>
<div>IAM Support Engineer<br>
    Identity and Access Management,</div>
<div>    Information Technology Services</div>
<div>University of California, San Francisco</div>
<div><br>
</div>
</div>
</div>
<br class="m_5182842875976811038Apple-interchange-newline">
</div>
<br class="m_5182842875976811038Apple-interchange-newline">
<br class="m_5182842875976811038Apple-interchange-newline">
</div>
<br>
</div>
</div>

<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>