<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 15/12/2017 à 00:37, Cantor, Scott a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:6BFAC2EC-B4C1-486B-B0C2-88FBC391B217@osu.edu">
<pre wrap="">On 12/14/17, 6:05 PM, "users on behalf of Jehan Procaccia" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofjehan.procaccia@tem-tsp.eu"><users-bounces@shibboleth.net on behalf of jehan.procaccia@tem-tsp.eu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">which one ? probably
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/PersistentNameIDGenerationConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/PersistentNameIDGenerationConfiguration</a>
can you confirm ?
</pre>
</blockquote>
<pre wrap="">
That is the only documentation there is, yes.
</pre>
</blockquote>
<p>OK, then I followed that doc, configured my IDP keeping the
default Transient nameID and added
shibboleth.SAML2PersistentGenerator in saml-nameid.xml<br>
<br>
</p>
<p><util:list id="shibboleth.SAML2NameIDGenerators"><br>
<ref bean="shibboleth.SAML2TransientGenerator" /><br>
<!-- Uncommenting this bean requires configuration in
saml-nameid.properties. --><br>
<b> <ref bean="shibboleth.SAML2PersistentGenerator"
/></b><br>
</util:list><br>
</p>
<p>and in saml-nameid.properties I uncommented as recommended for
computedID without DB<br>
<br>
</p>
<p># For computed IDs, set a source attribute and a secret salt:<br>
idp.persistentId.sourceAttribute = eduPersonPrincipalName<br>
idp.persistentId.useUnfilteredAttributes = true<br>
# Do *NOT* share the salt with other people, it's like divulging
your private key.<br>
idp.persistentId.algorithm = SHA<br>
idp.persistentId.salt = secret<br>
<br>
</p>
<p>but still accessing <br>
</p>
<pre wrap=""><a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/saml2-acs.php/default-sp</a>
with those metadata requesting an eduPersonTargetedID and a persistent nameID-format
</pre>
<pre wrap=""><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:<b>nameid-format:persistent<</b>/md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:RequestedAttribute Name="urn:oid:<b>1.3.6.1.4.1.5923.1.1.1.10</b>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/></pre>
<p>doesn't work .</p>
<p>How can I check (local to IDP) that I do generate a persitendID ?
<br>
</p>
<p>as suggested previously by Peter, aacli does show me attributes ,
but it doesn't show me nameIDs , is there another tool ? <br>
</p>
<p>[root@idpr3 shibboleth-idp]# ./bin/<b>aacli.sh </b>--requester=<a class="moz-txt-link-freetext" href="https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp">https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp</a>
--configDir=conf/ --principal=procaccia <b>--saml2</b></p>
<p><b></b><br>
<i><?xml version="1.0" encoding="UTF-8"?></i><i><br>
</i><i><saml2:Assertion ID="_54ee1b2ba156f6c80ec2154ca23c7528"</i><i><br>
</i><i> IssueInstant="2017-12-15T19:57:45.542Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></i><i><br>
</i><i>
<saml2:Issuer><a class="moz-txt-link-freetext" href="https://idp3.tem-tsp.eu/idp/shibboleth">https://idp3.tem-tsp.eu/idp/shibboleth</a></saml2:Issuer></i><i><br>
</i><i> <saml2:AttributeStatement></i><i><br>
</i><i> <saml2:Attribute FriendlyName="uid"</i><i><br>
</i><i> Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></i><i><br>
</i><i> <saml2:AttributeValue</i><i><br>
</i><i>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a></i><i><br>
</i><i>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">procaccia</saml2:AttributeValue></i><i><br>
</i><i> </saml2:Attribute></i><i><br>
</i><i> <saml2:Attribute FriendlyName="mail"</i><i><br>
</i><i> Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></i><i><br>
</i><i> <saml2:AttributeValue</i><i><br>
</i><i>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a></i><i><br>
</i><i>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:jehan.procaccia@tem-tsp.eu">jehan.procaccia@tem-tsp.eu</a></saml2:AttributeValue></i><i><br>
</i><i> </saml2:Attribute></i><i><br>
</i><i> <saml2:Attribute
FriendlyName="eduPersonPrincipalName"</i><i><br>
</i><i> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></i><i><br>
</i><i> <saml2:AttributeValue</i><i><br>
</i><i>
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a></i><i><br>
</i><i>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string"><a class="moz-txt-link-abbreviated" href="mailto:procaccia@tem-tsp.eu">procaccia@tem-tsp.eu</a></saml2:AttributeValue></i><i><br>
</i><i> </saml2:Attribute></i><i><br>
</i><i> </saml2:AttributeStatement></i><i><br>
</i><i></saml2:Assertion></i><br>
<br>
I keep using DEBUG in my IDP , I copy below ligns containing
NameID keyword :<br>
</p>
<p><i>2017-12-15 20:59:33,646 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] -
Profile Action AddNameIDToSubjects: Attempting to add NameID to
outgoing Assertion Subjects</i><i><br>
</i><i>2017-12-15 20:59:33,646 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:139]
- No object to operate on, returning true</i><i><br>
</i><i>2017-12-15 20:59:33,647 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- Metadata specifies the following formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent,
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]</i><i><br>
</i><i>2017-12-15 20:59:33,647 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
- Configuration specifies the following formats: []</i><i><br>
</i><i>2017-12-15 20:59:33,647 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:113]
- Configuration did not specify any formats, relying on metadata
alone</i><i><br>
</i><i>2017-12-15 20:59:33,647 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] -
Profile Action AddNameIDToSubjects:<b> Candidate NameID formats:
[urn:oasis:names:tc:SAML:2.0:nameid-format:persistent,
urn:oasis:names:tc:SAML:2.0:nameid-format:transient]</b></i><i><br>
</i><i>2017-12-15 20:59:33,647 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] -
Profile Action AddNameIDToSubjects: <b>Trying to generate
NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</b></i><i><br>
</i><i>2017-12-15 20:59:33,648 - <b>ERROR </b>[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404]
- Profile Action AddNameIDToSubjects: <b>Error while generating
NameID</b></i><i><br>
</i><i>org.opensaml.saml.common.SAMLException: Invalid
NameIdentifierGenerationService configuration</i><i><br>
</i><i> at
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)</i><i><br>
</i><i><br>
</i></p>
<p>Although PersistendID seems to be generated here at lign "<i>2017-12-15
20:59:33,647"</i>, if fails with an error.</p>
<p>what is wrong in my settings ? <br>
</p>
<p>If I finally succeed in creating an persistent nameID within
saml-nameid.xml and in .properties without error, do I need later
on to construct the eduPersonTargetedID and how to "map" it to the
Persistent NameID juste created for the session ?</p>
<p>for storeID I found sample at
<a class="moz-txt-link-freetext" href="https://services.renater.fr/federation/docs/installation/idp3/chap11#creer_un_attribut_persistentidedupersontargetedid">https://services.renater.fr/federation/docs/installation/idp3/chap11#creer_un_attribut_persistentidedupersontargetedid</a><br>
</p>
<pre class="code xml"><span style="background-color:#ff0"> <span class="sc-1"><!-- Targeted ID/Persistent ID --></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:AttributeDefinition</span> <span class="re0">id</span>=<span class="st0">"eduPersonTargetedID"</span> <span class="re0">xsi:type</span>=<span class="st0">"ad:SAML2NameID"</span> <span class="re0">sourceAttributeID</span>=<span class="st0">"persistentID"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">nameIdFormat</span>=<span class="st0">"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</span><span class="re2">></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:Dependency</span> <span class="re0">ref</span>=<span class="st0">"myStoredId"</span> <span class="re2">/></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:DisplayName</span> <span class="re0">xml:lang</span>=<span class="st0">"en"</span><span class="re2">></span></span>Targeted ID<span class="sc3"><span class="re1"></resolver:DisplayName<span class="re2">></span></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:DisplayDescription</span> <span class="re0">xml:lang</span>=<span class="st0">"en"</span><span class="re2">></span></span>Targeted ID: A unique identifier for a person, different for each service provider.<span class="sc3"><span class="re1"></resolver:DisplayDescription<span class="re2">></span></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:AttributeEncoder</span> <span class="re0">xsi:type</span>=<span class="st0">"enc:SAML1XMLObject"</span> <span class="re0">name</span>=<span class="st0">"urn:oid:1.3.6.1.4.1.5923.1.1.1.10"</span> <span class="re2">/></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:AttributeEncoder</span> <span class="re0">xsi:type</span>=<span class="st0">"enc:SAML2XMLObject"</span> <span class="re0">name</span>=<span class="st0">"urn:oid:1.3.6.1.4.1.5923.1.1.1.10"</span> <span class="re0">friendlyName</span>=<span class="st0">"eduPersonTargetedID"</span> <span class="re2">/></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"></resolver:AttributeDefinition<span class="re2">></span></span></span></span>
<span style="background-color:#ff0"> </span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:DataConnector</span> <span class="re0">id</span>=<span class="st0">"myStoredId"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">xsi:type</span>=<span class="st0">"dc:StoredId"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">generatedAttributeID</span>=<span class="st0">"persistentID"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">sourceAttributeID</span>=<span class="st0">"eduPersonPrincipalName"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">salt</span>=<span class="st0">"%{idp.persistentId.salt}"</span></span></span>
<span class="sc3"><span style="background-color:#ff0"> <span class="re0">queryTimeout</span>=<span class="st0">"0"</span><span class="re2">></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:Dependency</span> <span class="re0">ref</span>=<span class="st0">"%{idp.persistentId.sourceAttribute}"</span> <span class="re2">/></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"><dc:BeanManagedConnection<span class="re2">></span></span></span>shibboleth.MysqlDataSource<span class="sc3"><span class="re1"></dc:BeanManagedConnection<span class="re2">></span></span></span></span>
<span style="background-color:#ff0"> <span class="sc3"><span class="re1"></resolver:DataConnector<span class="re2">></span></span></span></span></pre>
<p>but here the<br>
</p>
<pre class="code xml"><span style="background-color:#ff0"> <span class="sc3"><span class="re1"><resolver:Dependency</span> <span class="re0">ref</span>=<span class="st0">"myStoredId"</span> <span class="re2">/></span></span></span></pre>
<p>should be replace with what ? some kind of "myComputedId" !?<br>
</p>
<p>thanks.<br>
</p>
</body>
</html>