<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><p style="margin: 0px;" data-mce-style="margin: 0px;">Hello</p><p style="margin: 0px;" data-mce-style="margin: 0px;">Some SP and vendors wants a particular nameID to authorize acces to their services, ei eduPersonTargetedID as a persistentID<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">I want to be able to send this particular nameID only to specific SPs <br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">but still take advantage of a default <i>nameid-format:</i><i>transient</i> for the other majority of SPs , so that I am not exposed to a global failure if a the eduPersonTargeted storeID DB fails<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">I figured out that doc related to that purpose <a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" data-mce-href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">so I uncommented in saml-nameid.properties<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;"># For computed IDs, set a source attribute and a secret salt:<br> idp.persistentId.sourceAttribute = mail<br> idp.persistentId.useUnfilteredAttributes = true<br> # Do *NOT* share the salt with other people, it's like divulging your private key.<br> idp.persistentId.algorithm = SHA<br> idp.persistentId.salt = secret<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">and uncommented bold section below in saml-nameid.xml expecting to get a Persitent nameID format for the targeted SP <a class="moz-txt-link-rfc2396E" href="https://services.renater.fr/shibboleth" data-mce-href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><!-- SAML 2 NameID Generation --><br> <util:list id="shibboleth.SAML2NameIDGenerators"><br> <br> <ref bean="shibboleth.SAML2TransientGenerator" /><br> <br> <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --><br> <b><ref bean="shibboleth.SAML2PersistentGenerator" /></b><b><br> </b><b><br> </b><b> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</b><b><br> </b><b> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</b><b><br> </b><b> p:attributeSourceIds="#{ {'mail'} }" ></b><b><br> </b><b><br> </b><b> <property name="activationCondition"></b><b><br> </b><b> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate=<a class="moz-txt-link-rfc2396E" href="https://services.renater.fr/shibboleth" data-mce-href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a> /></b></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><b> </bean></b><br> </property><br> </util:list><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Unfortunaltly is doesn't seem to work according to IDP's process log: <br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">but regarding nameID there is a pb <br> 2017-12-11 16:10:57,297 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action <b>AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient</b><b><br> </b><b>2017-12-11 16:10:57,298 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID</b><br> org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration<br> at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)<br> 2017-12-11 16:10:57,299 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">1st it tries to send a transient namedID , although I expected a computed on the fly persitenID based on mail attribute regarding my config <i>bean="shibboleth.SAML2PersistentGenerator</i><b> </b>above<b><br> </b></p><p style="margin: 0px;" data-mce-style="margin: 0px;">2nd it fails => Unable to generate a NameID, leaving empty</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">although finally there seems to be a transient namedID though !? <br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] - 20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411aa04d9cff0e56166ea4ac8e2725a4|<a class="moz-txt-link-freetext" href="https://services.renater.fr/shibboleth%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp3.tem-tsp.eu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f6c77f00f87dfbee3b92b4581800aae4%7Cprocaccia%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" data-mce-href="https://services.renater.fr/shibboleth%7Chttp://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://idp3.tem-tsp.eu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f6c77f00f87dfbee3b92b4581800aae4%7Cprocaccia%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">https://services.renater.fr/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3.tem-tsp.eu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87dfbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</a><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">|uid,mail,eduPersonPrincipalName||<b>_4c7ace16b2aa2056cec31abf2591e650</b>|<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Where did I done wrong ? <br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">regards .<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p></div></div></body></html>