<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div>So I found the solution in the comments of conf/saml-nameid.xml, which contained a definition for SAML2AttributeSourcedGenerator. I've managed to adapt it in a way, that makes it do what I need:</div>
<div><br>
</div>
<div><bean parent="shibboleth.SAML2AttributeSourcedGenerator"</div>
<div>p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"</div>
<div>p:attributeSourceIds="#{ {'ImmutableID'} }" /></div>
<div><br>
</div>
<div>Thank you,</div>
<div>kind regards,</div>
<div>Thomas Käfer</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); --darkreader-inline-color:#e8e6e3; --darkreader-inline-bgcolor:#262a2b;" data-darkreader-inline-color="" data-darkreader-inline-bgcolor="">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); --darkreader-inline-color:#e8e6e3; --darkreader-inline-bgcolor:#262a2b;" data-darkreader-inline-color="" data-darkreader-inline-bgcolor="">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Mittwoch, 23. März 2022 00:03<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> How to use NameID source Attribute as-is 1:1, without hashing?</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">Hello everyone!
<div><br>
</div>
<div>I'm currently trying to setup an IDP 4.1.5 server to replace an IDP 2.3.8 one that we use to authenticate users to Microsoft services.</div>
<div><br>
</div>
<div>The stumbling stone I've been trying to overcome for the last few days is this question:</div>
<div><br>
</div>
<div>How do I get an existing attribute (loaded through a DataConnector defined in attribute-resolver.xml) to be used as-is 1:1 (not as a source attribute for a hash function) as the persistent nameid that Microsoft checks for in my IDPs auth response?</div>
<div><br>
</div>
<div>On the IDP 2.3.8 this was all I needed:</div>
<div><br>
</div>
<div> <resolver:AttributeDefinition id="ImmutableID" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="ImmutableID"></div>
<div> <resolver:Dependency ref="myDataConnector" /></div>
<div> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /></div>
<div> </resolver:AttributeDefinition></div>
<div><br>
</div>
<div>But as this page tells us:</div>
<div>https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2524447292/DeprecatedIdPV4</div>
<div>> The encoder type "SAML2StringNameID" has been depricated in favor of NameID Generation service.</div>
<div><br>
</div>
<div>Sadly, both the supported strategies don't seem to be able to do what I need:</div>
<div>https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631673/PersistentNameIDGenerationConfiguration</div>
<div><br>
</div>
<div>Is there any way to get the functionality described above with just configuration, or do I need to write Java code, maybe a customized version of shibboleth.SAML2PersistentGenerator, shibboleth.StoredPersistentIdGenerator, or some other class?</div>
<div><br>
</div>
<div>Thank you,</div>
<div>kind regards,</div>
Thomas Käfer </div>
<div style="font-size:10pt; font-family: 'Verdana',sans-serif;">
<p>Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung </p>
</div>
</body>
</html>