<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi folks.
<div class=""><br class="">
</div>
<div class="">Is it possible to configure the SAML2TransientGenerator to send an attribute sourced value (similar to a persistent ID or other non-transient NameID)? If so, is there documentation on how this might be done?</div>
<div class=""><br class="">
</div>
<div class="">Why you might ask? A (well known database) vendor’s application already integrated with our soon-to-be upgraded IdP version 2.3.8 environment requires a NameID in the SAML response with a format defined as "urn:oasis:names:tc:SAML:2.0:nameid-format:transient”
but whose actual value is a user ID which they use as their primary key for the application. It was successfully integrated (by someone before my tenure) with our IdP 2.3.8 environment by adding</div>
<div class="">——</div>
<div class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"<br class="">
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></div>
<div class="">——</div>
<div class="">to the attribute definition in the attribute-resolver.xml configuration.</div>
<div class=""><br class="">
</div>
<div class="">I’ve informed the application owner that this misuse of the NameID format will need to be changed, but it’s rather unlikely they’ll be able to get the vendor to modify their code before we need to put IdP 3.3 into production.</div>
<div class=""><br class="">
</div>
<div class="">I’ve tried adding the below bean to the SAML2NameIDGenerators list in the conf/saml-nameid.xml configuration.</div>
<div class="">——</div>
<div class=""> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br class="">
p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"<br class="">
p:attributeSourceIds="#{ {<br class="">
'uidNameID'<br class="">
} }"><br class="">
</bean><br class="">
——</div>
<div class="">but the NameID value produced in the SAML response still contains the generated transient ID string rather than the attribute value.</div>
<div class=""><br class="">
</div>
<div class="">The “uidNameID” attribute is defined in the attribute-resolver.xml and the SAML response includes that attribute and correct value.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">----</div>
<div class="">Nathan Sheldon</div>
<div class="">IAM Support Engineer<br class="">
Identity and Access Management,</div>
<div class=""> Information Technology Services</div>
<div class="">University of California, San Francisco</div>
<div class=""><br class="">
</div>
</div>
</div>
<br class="Apple-interchange-newline">
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</body>
</html>