<div>Hi,</div>
<div> </div>
<div>Thanks for your help.</div>
<div> </div>
<div>For now, IdP is just a rich piece of Java software for me. I know a bit about SAML, federations, ... but I still have no clues about the context, why exactly we have one and what SPs are used or not among the different federations we joined.</div>
<div> </div>
<div>We don't have any SP as far as I know. So I am trying to be ready for anything and learing with trial/errors. </div>
<div> </div>
<div>If I had some time, I would try to setup a SP and expriment a little.</div>
<div> </div>
<div>Is there some tool a bit like "aacli" but able to mimic some kind of "dummy SP" ? Only sending forged SAML requests and getting the responses, just for debug and learning purpose.</div>
<div> </div>
<div>I was not able to find one until now but I don't really know how to name that.</div>
<div> </div>
<div>Regards<br /><br />Le 08-Nov-2022 18:12:17 +0100, ndk@signet.id a écrit:</div>
<blockquote style="margin-left: 0; padding-left: 5px; border-left: 2px solid #000080;">SPF,<br /><br />You probably want to leave the default as transient, because that is what will apply for service providers that have nothing in particular specified for them.<br /><br />For this scenario, you could add the preferred format to their metadata, which is probably the best way, they could add it to their AuthnRequests, or you can explicitly put in a relying party definition. It'll follow the selection pattern described in the documentation.<br /><br /><NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat><br /><br />Let me know if you need any more specific assistance,<br />Nate<br /><br />--------<br />Signet, Inc.<br />The Art of Access ®<br /><br /><a href="https://www.signet.id" target="_blank" rel="noreferrer noopener">https://www.signet.id</a><br /><br />-----Original message-----<br />From: spf via users<br />Sent: Tuesday, November 8 2022, 9:54 am<br />To: <a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer noopener">users@shibboleth.net</a><br />Cc: spfma.tech@e.mail.fr<br />Subject: Re: Storing persistentId using an HTTP DataConnector<br /><br />Thank you and Nate.<br /><br />In fact, I am just a bit dumb and/or blind : I have read these pages a couple of times, edited my saml-nameid.* files even more.<br /><br />But if I am not able to spot "#idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient", what to do ?<br /><br />So with "idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" I get the expected result !<br /><br />Regards<br /><br />Le 08-Nov-2022 16:56:13 +0100, <a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer noopener">users@shibboleth.net</a> a écrit:<br /><br />* spf via users <<a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer noopener">users@shibboleth.net</a> <mailto:<a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer noopener">users@shibboleth.net</a>>> [2022-11-08 16:30]:<br />> The only thing I can't undersand for now is how to have a persistent<br />> NameID in the SAML assertions. If the SAML2PersistentGenerator only<br />> is enabled, there is even no subject. But if SAML2TransientGenerator<br />> or both are enabled, I have a<br /><br />In my conf/saml-nameid.xml within <util:list<br />id="shibboleth.SAML2NameIDGenerators"> I have multiple *Generator<br />elements, all "active" in the configuration and used when needed<br />(based on the NameID selection process Nate pointed you to):<br /><br /><util:list id="shibboleth.SAML2NameIDGenerators"><br /><ref bean="shibboleth.SAML2TransientGenerator" /><br /><ref bean="shibboleth.SAML2PersistentGenerator" /><br /><bean parent="shibboleth.SAML2AttributeSourcedGenerator" ...<br /><bean parent="shibboleth.SAML2AttributeSourcedGenerator" ...<br /><bean parent="shibboleth.SAML2AttributeSourcedGenerator" ...<br /></util:list><br /><br />HTH,<br />-peter<br />-- <br />For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" target="_blank" rel="noreferrer noopener">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a> <<a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" target="_blank" rel="noreferrer noopener">https://shibboleth.atlassian.net/wiki/x/ZYEpPw></a><br />To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer noopener">users-unsubscribe@shibboleth.net</a> <mailto:<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer noopener">users-unsubscribe@shibboleth.net</a>><br /><br />-----------<br />FreeMail powered by mail.fr <<a href="https://mail.fr" target="_blank" rel="noreferrer noopener">https://mail.fr></a><br /><br />--<br /><br />For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" target="_blank" rel="noreferrer noopener">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br /><br />To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer noopener">users-unsubscribe@shibboleth.net</a><br /><br /><br /></blockquote>
<div style="font-family: arial, helvetica,sans-serif; font-size: 10pt; color: #000000;"> </div>
<hr />
<div style="font-family: arial, helvetica,sans-serif; font-size: 10pt; color: #000000;">FreeMail powered by <a href="https://mail.fr" target="_blank" rel="noreferrer noopener">mail.fr</a></div>
<br/><hr>FreeMail powered by <a href="https://mail.fr" target="_blank">mail.fr</a>