<div dir="ltr"><div dir="ltr">Hi All,<div><br></div><div><div>We're running Shibboleth 3.3.x and in the past I've setup several SP's to use persistent IDs. For example:</div><div><br></div><div>conf/saml-nameid.xml</div><div><br></div><div>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div><div>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent"</div><div>             p:attributeSourceIds="#{ {'employeeID'} }"></div><div>             <property name="activationCondition"></div><div>                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="SOMEID" /></div><div>             </property></div><div>         </bean></div><div><br></div><div>conf/relying-party.xml</div><div><br></div><div>        <bean parent="RelyingPartyByName" c:relyingPartyIds="SOMEID"></div><div>            <property name="profileConfigurations"></div><div>                <list></div><div>                    <bean parent="SAML2.SSO"</div><div>                          p:includeAttributeStatement="true"</div><div>                          p:assertionLifetime="PT5M"</div><div>                          p:signResponses="true"</div><div>                          p:signAssertions="true"</div><div>                          p:encryptAssertions="false" /></div><div>                </list></div><div>            </property></div><div>        </bean></div><div><br></div><div>conf/metadata-providers.xml</div><div><br></div><div>        <metadata:MetadataProvider id="SP_NAME" xsi:type="metadata:FilesystemMetadataProvider"<br></div><div>                          xmlns="urn:mace:shibboleth:2.0:metadata"</div><div>                          metadataFile="/path/to/sp-metadata.xml"></div><div>        </metadata:MetadataProvider></div><div><br></div><div><br></div><div>employeeID as defined in conf/attribute-resolver.xml</div><div><br></div><div>        <resolver:AttributeDefinition xsi:type="ad:Simple" id="employeeID" sourceAttributeID="eID"></div><div>            <resolver:Dependency ref="eID" /></div><div>            <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:persistent" /></div><div>        </resolver:AttributeDefinition></div><div><br></div><div>And I made sure employeeID is being released to the SP in conf/relying-filter.xml.</div><div><br></div><div>I'm attempting to setup a new SP the same way, but for some reason it's still using a transient NameID. It's as if the activation condition isn't being triggered.</div><div><ul><li>Am I correct that the c:candidate value in conf/saml-nameid.xml should be the entityID in the SP's metadata?<br></li><li>If not, what should that value be?<br></li><li>If so, does anyone have any ideas of some common mistakes I should double check for?<br></li></ul></div><div>If I should provide some additional info, just let me know.<br></div><div><br></div><div>Thanks,</div><div>Jason</div></div><div><br></div><div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><pre cols="72">Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505<br></pre><pre cols="72">Think BEFORE You Click!! Emails from Swarthmore College ITS won't be in your
Quarantine or Spam folder. We won't threaten you either! If you
receive any phishing emails, please forward them to <a href="mailto:phishing@swarthmore.edu" target="_blank">phishing@swarthmore.edu</a>.<br></pre></div></div></div></div></div></div></div></div>