<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">We do this for a few specific SPs. Here’s our saml-nameid.xml config:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <util:list id="shibboleth.SAML2NameIDGenerators"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <ref bean="shibboleth.SAML2TransientGenerator" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> p:format="urn:oid:1.3.6.1.4.1.32548.1.1.2"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> p:attributeSourceIds="#{ {'campusPermanentId'} }" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">And here’s our attribute-filter.xml config to release that attribute:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <AttributeFilterPolicy id="releaseCollegeID"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <PolicyRequirementRule xsi:type="Requester" value="https://vendor.entity.id.here" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <AttributeRule attributeID="campusPermanentId"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <PermitValueRule xsi:type="ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">And finally, their metadata is calling out for this particular NameID claim type:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <md:NameIDFormat>urn:oid:1.3.6.1.4.1.32548.1.1.2</md:NameIDFormat><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> <!-- other stuff here --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </md:SPSSODescriptor><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">If their metadata isn’t calling for it explicitly, I suppose that’s where you need a little more config customization to get you over the hurdle.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Todd<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Jehan PROCACCIA<br>
<b>Sent:</b> Wednesday, December 13, 2017 9:06 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> persitentID nameID for specific SPs, transient for default<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">Hello<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">Some SP and vendors wants a particular nameID to authorize acces to their services, ei eduPersonTargetedID as a persistentID<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">I want to be able to send this particular nameID only to specific SPs
<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">but still take advantage of a default
<i>nameid-format:transient</i> for the other majority of SPs , so that I am not exposed to a global failure if a the eduPersonTargeted storeID DB fails<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">I figured out that doc related to that purpose
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration">
https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">so I uncommented in saml-nameid.properties<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"># For computed IDs, set a source attribute and a secret salt:<br>
idp.persistentId.sourceAttribute = mail<br>
idp.persistentId.useUnfilteredAttributes = true<br>
# Do *NOT* share the salt with other people, it's like divulging your private key.<br>
idp.persistentId.algorithm = SHA<br>
idp.persistentId.salt = secret<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">and uncommented bold section below in saml-nameid.xml expecting to get a Persitent nameID format for the targeted SP
<a href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><!-- SAML 2 NameID Generation --><br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
<br>
<ref bean="shibboleth.SAML2TransientGenerator" /><br>
<br>
<!-- Uncommenting this bean requires configuration in saml-nameid.properties. --><br>
<b><ref bean="shibboleth.SAML2PersistentGenerator" /><br>
<br>
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"<br>
p:attributeSourceIds="#{ {'mail'} }" ><br>
<br>
<property name="activationCondition"><br>
<bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate=<a href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a> /></b><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><b><span style="font-family:"Arial",sans-serif;color:black"> </bean></span></b><span style="font-family:"Arial",sans-serif;color:black"><br>
</property><br>
</util:list><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">Unfortunaltly is doesn't seem to work according to IDP's process log:
<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">but regarding nameID there is a pb
<br>
2017-12-11 16:10:57,297 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action
<b>AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient<br>
2017-12-11 16:10:57,298 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID</b><br>
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration<br>
at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)<br>
2017-12-11 16:10:57,299 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">1st it tries to send a transient namedID , although I expected a computed on the fly persitenID based on mail attribute regarding my config
<i>bean="shibboleth.SAML2PersistentGenerator</i><b> </b>above<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">2nd it fails => Unable to generate a NameID, leaving empty<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">although finally there seems to be a transient namedID though !?
<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] - 20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411aa04d9cff0e56166ea4ac8e2725a4|<a href="https://services.renater.fr/shibboleth%7Chttp:/shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps:/idp3.tem-tsp.eu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f6c77f00f87dfbee3b92b4581800aae4%7Cprocaccia%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">https://services.renater.fr/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87dfbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</a><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">|uid,mail,eduPersonPrincipalName||<b>_4c7ace16b2aa2056cec31abf2591e650</b>|<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">Where did I done wrong ?
<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black">regards .<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>