<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
You probably need to use an activation condition in conf/saml-nameid.xml, but ...<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Why not tell the vendor you're happy to release 'mail' as 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' instead? An email address does not meet the requirements of the SAML spec for a persistent NameID.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,<br>
</div>
<div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<span style="font-family:Arial,Helvetica,sans-serif">Andy Morgan</span><span><br>
</span></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<div><span style="font-family:Arial,Helvetica,sans-serif">Identity & Access Management</span><br>
</div>
<div><span style="font-family:Arial,Helvetica,sans-serif">Oregon State University</span><br>
</div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Joshua Brodie <josbrodie@gmail.com><br>
<b>Sent:</b> Wednesday, August 5, 2020 4:23 PM<br>
<b>To:</b> users <users@shibboleth.net><br>
<b>Subject:</b> urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi List:</div>
<div><br>
</div>
<div>Been away for few weeks on another project and my brain is back on SAML.</div>
<div><br>
</div>
<div>In v3.4.7, we have the following:<br>
</div>
<div><br>
</div>
<div>idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator</div>
<div><br>
</div>
<div>Where it generates the eduPersonTargetedID based on a seed/salt pair.<br>
</div>
<div><br>
</div>
<div>But we now need to make the value sent under 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' dynamic. A SP is requesting 'mail' as 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'.<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I thought I could override the source attribute via 'saml-nameid.xml' -- but can't seem to. urn:oasis:names:tc:SAML:2.0:nameid-format:persistent always resorts to the eduPersonTargetedID value.
<br>
</div>
<div><br>
</div>
<div>I am certain I am missing something. But not so sure where.<br>
</div>
</div>
</div>
</div>
</body>
</html>