<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 16/12/2017 à 18:40, Andrew Morgan a
écrit :<br>
</div>
<br>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1712160925290.32369@shell.onid.oregonstate.edu">The
NameID generation is separate from the attribute resolution. Now
that you have the NameID working, you can generate the
eduPersonTargetedID by modifying attribute-resolver.xml. Here is
my configuration:
<br>
<br>
<!-- Computed targeted ID connector -->
<br>
<DataConnector xsi:type="ComputedId"
<br>
id="computedID"
<br>
generatedAttributeID="computedID"
<br>
sourceAttributeID="<your-source-attribute>"
<br>
salt="%{idp.persistentId.salt}">
<br>
<Dependency ref="myLDAP" />
<br>
</DataConnector>
<br>
<br>
<AttributeDefinition xsi:type="SAML2NameID"
id="eduPersonTargetedID"
<br>
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
sourceAttributeID="computedID">
<br>
<Dependency ref="computedID" />
<br>
<AttributeEncoder xsi:type="SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<br>
<AttributeEncoder xsi:type="SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" />
<br>
</AttributeDefinition>
<br>
<br>
</blockquote>
thanks a lot Andrew for the example, it is what I was looking for,
unfortunatly with this example my IDP fails on apparently a syntax
pb :<br>
<br>
<i>2017-12-18 10:27:23,825 - ERROR
[org.springframework.web.context.ContextLoader:353] - Context
initialization failed</i><i><br>
</i><i>
org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'shibboleth.AttributeResolverService'
defined in file
[/opt/shibboleth-idp/system/conf/services-system.xml]: Invocation
of init method failed; nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Service 'shibboleth.AttributeResolverService': could not perform
initial load</i><i><br>
</i><i>
at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1578)</i><i><br>
</i><i>
Caused by:
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Service 'shibboleth.AttributeResolverService': could not perform
initial load</i><i><br>
</i><i>
at
net.shibboleth.utilities.java.support.service.AbstractReloadableService.doInitialize(AbstractReloadableService.java:179)</i><i><br>
</i><i>
Caused by:
net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
Line 340 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver-ldap.xml] is invalid;
nested exception is org.xml.sax.SAXParseException; lineNumber:
340; columnNumber: 61; cvc-elt.4.2:<b> Cannot resolve 'ComputedId'
to a type definition for element 'resolver:DataConnector'.</b></i><i><br>
</i><i>
at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)</i><i><br>
</i><i>
Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
<b>Line 340 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver-ldap.xml] is
invalid; nested exception is org.xml.sax.SAXParseException;
lineNumber: 340; columnNumber: 61; cvc-elt.4.2: Cannot resolve
'ComputedId' to a type definition for element
'resolver:DataConnector'.</b></i><i><br>
</i><i>
at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)</i><i><br>
</i><i>
Caused by: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot
resolve 'ComputedId' to a type definition for element
'resolver:DataConnector'.</i><i><br>
</i><i>
at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)</i><i><br>
</i><br>
perhaps the warning mention on
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector">https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector</a>
regarding different xml schema whether we use 3.3 or lower , mine
3.2 !?<br>
<br>
suffixes as<b> dc</b> or <b>ad</b> needs to be added for me in v
3.2 ?<br>
as in <br>
<DataConnector xsi:type="<b>dc:</b>ComputedId"
?<br>
or<br>
<resolver:AttributeDefinition id="eduPersonTargetedID" xsi:type="<b>ad:</b>SAML2NameID"<br>
<br>
here's what I have set :<br>
<br>
<resolver:DataConnector xsi:type="ComputedId"<br>
id="computedID"<br>
generatedAttributeID="computedID"<br>
sourceAttributeID="eduPersonPrincipalName"<br>
salt="%{idp.persistentId.salt}"><br>
<resolver:Dependency ref="myLDAP" /><br>
</resolver:DataConnector><br>
<br>
<br>
<resolver:AttributeDefinition xsi:type="SAML2NameID"
id="eduPersonTargetedID"<br>
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
sourceAttributeID="computedID"><br>
<resolver:Dependency ref="computedID" /><br>
<resolver:AttributeEncoder xsi:type="SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /><br>
<resolver:AttributeEncoder xsi:type="SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" /><br>
</resolver:AttributeDefinition><br>
<br>
is there something wrong in my syntax ?<br>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1712160925290.32369@shell.onid.oregonstate.edu">The
ComputedID DataConnector
(<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector">https://wiki.shibboleth.net/confluence/display/IDP30/ComputedIdConnector</a>)
builds the hashed value from the source attribute, the same as the
shibboleth.ComputedPersistentIdGenerator does. The
eduPersonTargetedID attribute definition encodes it as a
SAML2XMLObject, which is what the SP is expecting.
<br>
<br>
Once you have the eduPersonTargetedID attribute generated, modify
attribute-filter.xml to release it to the SP (the same way as any
other attribute is released).
<br>
</blockquote>
ok this was already done<br>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1712160925290.32369@shell.onid.oregonstate.edu"><br>
BTW, you may want to choose a different sourceAttribute than
eduPersonPrincipalName. You need a source attribute that is
persistent (long-lived and never re-used for a different
person/subject). Maybe eduPersonPrincipalName meets those
requirements for you, maybe not. We used an internal
IDM-generated identifier as our source attribute instead.
<br>
</blockquote>
for now eppn is not reused, but you are right, I will consider
perhaps a better sourceAttribute .<br>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1712160925290.32369@shell.onid.oregonstate.edu"><br>
Good luck!
<br>
<br>
Thanks,
<br>
Andy<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>