<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 14/12/2017 à 13:48, Peter Schober a
écrit :
</div>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
No. I was assuming you already had an existing AttributeDefinition to
create the eduPersonTargetedID SAML Attribute in your resolver (from
an IPD2 upgrade, possibly).
I don't have one such suggestion handy, maybe someone else can share a
IDPv3-style attribute defintion to create the eduPersonTargetedID
attribute.
(Personally I don't use that, my IDP only supports the proper NameID
format, not the SAML attribute. That's also easier to create in the
IDPv3. I forgot why you couldn't make use of that and why I suggested
the attribute variant. Possibly to stop you messing with NameIDs
completely?)
</pre>
</blockquote>
I don't want to use inapropriate or old V2 solution, I just want to
be able to connect to SPs that request an edupersonTargetedID <br>
so if NameID format in IDPv3 is the way to go , i will follow that
path .<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<blockquote type="cite">
<pre wrap="">So I build now eduPersonTargetedID as a simple attribute based on our ldap
eppn value
</pre>
</blockquote>
<pre wrap="">
That's certainly incorrect.</pre>
</blockquote>
OK, I will forget about that attribute construction<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">here are idp-process log when I connect now to
<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp">https://monitor.eduroam.org/sp</a>
</pre>
</blockquote>
<pre wrap="">
Please stop logging on DEBUG and simply use the aacli as intended!
I've even inluded an example invocation (with the correct entityID for
the SP you were trying to use) in my previous email. If used with the
--saml2 parameter you'll also see the NameID, not just the attributes.</pre>
</blockquote>
aacli with saml2, did'nt know about that option, good advice, here
it is with previous edupersonTargetedID constructed manually from
eppn :<br>
<br>
[root@idp3 shibboleth-idp]# ./bin/aacli.sh
--requester=<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp</a>
--configDir=conf/ --principal=procaccia --saml2<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<saml2:Assertion ID="_38093625045a81e832956b4cc49d8c03"<br>
IssueInstant="2017-12-14T17:11:51.494Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>
<saml2:Issuer><a class="moz-txt-link-freetext" href="https://idp3.tem-tsp.eu/idp/shibboleth">https://idp3.tem-tsp.eu/idp/shibboleth</a></saml2:Issuer><br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="uid"<br>
Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">procaccia</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="mail"<br>
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:jehan.procaccia@tem-tsp.eu">jehan.procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonTargetedID"<br>
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonPrincipalName"<br>
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue<br>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a></saml2:AttributeValue><br>
</saml2:Attribute><br>
</saml2:AttributeStatement><br>
</saml2:Assertion><br>
<br>
is that doc:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID</a><br>
the correct one to follow to create an eduPersonTargetedID as
requested by SPs like
<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp</a>
<br>
that publishes in their metadata : <br>
<br>
<pre wrap=""><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:RequestedAttribute Name="urn:oid:<b>1.3.6.1.4.1.5923.1.1.1.10</b>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/></pre>
I just want to be able to give that SP what it request. I've read
too many specs, docs , best practices, i'am lost , which one should
I follow to fullfill that SP ?<br>
<br>
<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">howerver I still cannot verify access to the service as of
<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp</a>
end up on a HTTP ERROR 500 !? (perhaps a pb on their side currently
...)
</pre>
</blockquote>
<pre wrap="">
FWIW, worked for me just now.</pre>
</blockquote>
still doesn't work for me, probably because I sent it a wrong
formated eduPersonTargetedID (for now) <br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
Use your own logs and/or the aacli tool, then you don't need external
serices to tell you what your IDP is doing.</pre>
</blockquote>
ok, thanks for the --saml2 option in aacli !<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">again, maybe I've been missleaded by "old docs/practices " ? , but
still I see lot of IDPs owners in my community generating that
eduPersonTargetedID persitendID on a DB (storeID) I am not following
that path until now for reason of simplicity and not having to
manage a DB (spof) , Is that persitendID with associated storeID a
best practice ?
</pre>
</blockquote>
<pre wrap="">
The way you produce persistent NameID values (and the value of an
eduPersonTargetedID attribute *is* a NameID of type persistent, as you
can clearly see in the XML you posted above from your DEBUG log!) has
nothing to do with any of the topics you're asking about here.</pre>
</blockquote>
i'am asking to produce an eduPersonTargetedID as a NameID of type
persistent to respect the desire of the SP metadata.<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
I.e., you can generate eduPersonTargetedID attributes (or not), or
create persistent NameIDs as intended in SAML2 (by using the IDPv3s
saml-nameid.* support for that), </pre>
</blockquote>
ok, I would like to support it as intended in SAML2 with my idpv3 .
<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">or support neither of those two,
*fully* *independent* of whether you create them dynamically or from a
database.
Without a database you cannot support reverse mapping of those
identifiers, of course. </pre>
</blockquote>
I would like to start simply that way (no DB) in order to validate
access to those SPs that need that attribute .<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">But you probably don't need that anyway (you'd
know if you'd needed it). And without the abstraction layer that a
database gives you you have no way to handle situations where a manual
intervention would be required to prevent use of a persistent NameID
value by another person (which strictly prohibited by the spec) or to
prevent a person recieving another NameID value (allowed by the spec,
but may disrupt service/data access for the subject, so not to be
taken lightly either).</pre>
</blockquote>
I will consider, latter on, to be conform to the spec, so I
understand that eventually I'll need a database to store mapping of
persitent NameID to real local username .<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
If you don't have plans to add more than 1 IDP node maybe look into
using sqlite for your IDP. (I do that myself, but it's really just a
toy IDP serving only a couple of people.)
That's just a simple file on disk, with no process running or any
other maintenance. No idea whether that would scale to your
deployment requirements, of course!</pre>
</blockquote>
<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
IMO the less suitable your base identifier is to generate persistent
NameID values from, the more likely it becomes you'll need to
intervene with the mapping at some point. E.g. in case the userid you
create persistent NameIDs from changes but you want to enable the
subject to continue accessing services with the same persistent NameID
values as before. Without a database (and when using unsuitable
identifiers as a source attribute) you're screwed, with no way to fix
that. With a database you could have the (hopefully automated!)
processes to detect such cases and simply update the userid in the
database, so that the new userid replaces the old one, leading to
continued use of the previously created and persistent NameID values.
Now if you neither have the processes to detect such cases (userid
change) nor the time/interest to hande those manually, well, you
wouldn't need the database anyway, so you might create those
persistent NameIDs values dynamically (and not store them) anyway.
Does that help?</pre>
</blockquote>
yes , I already manage other databases (mysql and postgresql), so I
could dare to get one for that purpose now that I kind of get
convince that it's necessary .<br>
I was initially expect to build a computed on the fly persistend
NameID for those specific and nearly unique SP (monitor.eduroam)
that asked for it, and leave all other SPs to the more traditional
an simple transient nameID.<br>
is it what will happen if I keep declare both transient and
persisten generator in saml-nameid.xml in that order?:<br>
<br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
<ref bean="shibboleth.SAML2TransientGenerator" /><br>
<ref bean="shibboleth.SAML2PersistentGenerator"
/><br>
<br>
No need to get into CustomNameIDGenerationConfiguration :<br>
<span style="font-family:"Arial",sans-serif;color:black">
<a
href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration"
target="_blank">
https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a><br>
nor list SPs in activationCondition <br>
</span><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions</a>
(<code class="xml spaces"></code><code class="xml color1">c:candidates</code><code
class="xml plain">=</code><code class="xml string">"#{{'<a
href="https://sp.example.com/shibboleth%27,">https://sp.example.com/shibboleth',</a>
'<a href="https://another.example.com/shibboleth%27%7D%7D">https://another.example.com/shibboleth'}}"</a></code>
<code class="xml plain">/></code><br>
if federation metadata ask explicitly for the correct nameIDs as is
the case with
entityID=<a class="moz-txt-link-rfc2396E" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">"https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp"</a>
<br>
<br>
I hope I will get a running config with all these advices .<br>
If you have a sample config, I'll appreciate .<br>
<br>
Thanks .<br>
<br>
jehan .<br>
<br>
<br>
<blockquote type="cite"
cite="mid:20171214124841.3g4mlhsc564hi4ef@aco.net">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I could concatenate name+birthdate or whatever with a
ScriptAttributeDefinition I guess
</pre>
</blockquote>
<pre wrap="">
Or Template, even simpler.
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/TemplateAttributeDefinition">https://wiki.shibboleth.net/confluence/display/IDP30/TemplateAttributeDefinition</a>
Cheers,
-peter
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>