Correct attribute to filter

[Michael Dahlberg]

I'm having a problem getting my IdP to provide the correct attributes to a
SP (maps.arcgis.com)

I've configured my IdP to release the userPrincipalName
<resolver:AttributeDefinition xsi:type="ad:Simple" id="userPrincipalName"
sourceAttributeID="userPrincipalName">
<resolver:Dependency ref="myLDAP" />
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
</resolver:AttributeDefinition>
and, by default, the transientId is released as well:

<resolver:AttributeDefinition id="transientId"
xsi:type="ad:TransientId">
<resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
</resolver:AttributeDefinition>

Configured in this manner, authentication occurs without a problem.
However, the site uses the transientId as the username. Obviously, this
is a problem because the work that a given user does is not available to
him/her on subsequent logins.

If I disable the release of the transientId by applying the following
Attribute Rule to this site's Attribute Filter Policy
<afp:AttributeRule attributeID="transientId">
<afp:DenyValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
authentication does not occur and I'm presented with the error "Unable to
login using Idp 'NAME_ID' not found in SAML response".

Is there any way I can create an attribute like the transientId that will
include 'NAME_ID' (not sure what that is) that I can then pass to the SP
with a consistent, easily recognizable value? Or am I approaching this in
the wrong manner?

Thanks,
Mike

[Ian Rifkin]

Hi Mike,

It sounds like you're on the right track. It sounds like they're looking at
the NAME ID
<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier>
(which is part of the subject in the SAML response from your IdP).

You need to setup a name id attribute
<https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringNameIDEncoder>
with the data you want in your resolver then add that (and deny the
transient id one) in your attribute-filter.

Hope that helps!

Ian

I've configured my IdP to release the userPrincipalName





Post by Michael Dahlberg
Is there any way I can create an attribute like the transientId that will
include 'NAME_ID' (not sure what that is) that I can then pass to the SP
with a consistent, easily recognizable value?

[Cantor, Scott]

Post by Michael Dahlberg
Is there any way I can create an attribute like the transientId that will
include 'NAME_ID' (not sure what that is) that I can then pass to the SP
with a consistent, easily recognizable value?

Yes.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

There are no standard formats for SAML NameIDs that are good identifiers
for users except for the persistent format, which is opaque and pairwise,
different for every SP. Deploying that requires a database, or a stable
underlying seed attribute.

Post by Michael Dahlberg
Or am I approaching this in the wrong manner?

Probably (most use SAML Attributes instead of subject identifiers, and
generally use something like the eduPersonPrincipalName attribute which is
common in higher ed), but the vendor's application may be broken and not
support SAML well. You may have to supply a custom or proprietary NameID
to satisfy it. They have to document that so you know what you have to
supply.

-- Scott