Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:persistentnameid [2018/04/09 10:02] procacci@tem-tsp.eu [attribute eduPersonTargetedID] |
docpublic:systemes:persistentnameid [2022/05/03 08:20] (current) adminjp [idp v4 logs] |
||
|---|---|---|---|
| Line 12: | Line 12: | ||
| * https:// | * https:// | ||
| - | ===== saml-nameid.properties | + | ===== nameID ===== |
| + | ==== saml-nameid.properties ==== | ||
| configure saml-nameid.properties to set the source attribute of a computed persistent ID | configure saml-nameid.properties to set the source attribute of a computed persistent ID | ||
| Line 44: | Line 45: | ||
| then we need to uncommented // <ref bean=" | then we need to uncommented // <ref bean=" | ||
| + | === idp v4 === | ||
| - | ===== saml-nameid.xml | + | quite the same as in V3 , except here we choose mail attribute and validate advice to use BASE32 encoding |
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim saml-nameid.properties | ||
| + | idp.persistentId.algorithm | ||
| + | idp.persistentId.salt = secretpasslongenough16bytes | ||
| + | idp.persistentId.sourceAttribute = mail | ||
| + | idp.persistentId.useUnfilteredAttributes = true | ||
| + | idp.persistentId.encoding = BASE32 | ||
| + | |||
| + | idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== saml-nameid.xml ==== | ||
| but finally , there' | but finally , there' | ||
| Line 77: | Line 93: | ||
| cf metadata below | cf metadata below | ||
| - | ===== metada requesting persistendID | + | |
| + | === idp v4 === | ||
| + | |||
| + | uncomment bean=" | ||
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim saml-nameid.xml | ||
| + | |||
| + | <!-- SAML 2 NameID Generation --> | ||
| + | < | ||
| + | |||
| + | <ref bean=" | ||
| + | |||
| + | <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> | ||
| + | <ref bean=" | ||
| + | </ | ||
| + | ==== metada requesting persistendID ==== | ||
| example | example | ||
| Line 132: | Line 164: | ||
| </ | </ | ||
| + | === resolver idp 4 === | ||
| - | ==== test / validate with aacli ===== | + | xml syntaxe changes sligthly : |
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim attribute-resolver-ldap.xml | ||
| + | |||
| + | < | ||
| + | < | ||
| + | nameIdFormat=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | excludeResolutionPhases=" | ||
| + | generatedAttributeID=" | ||
| + | salt=" | ||
| + | algorithm=" | ||
| + | encoding=" | ||
| + | |||
| + | < | ||
| + | |||
| + | </ | ||
| + | </ | ||
| + | |||
| + | ===== test / validate with aacli ====== | ||
| + | |||
| + | aacli.sh is a script that allows us to test locally what the IDP with send as nameIDs and attributes for a specific SP and associated principal (login) . we tes here our persistendID requested by SP and eduPersonTargetedID required : | ||
| < | < | ||
| Line 199: | Line 260: | ||
| </ | </ | ||
| + | === aacli idp v4 === | ||
| + | |||
| + | < | ||
| + | [root@idp4 shibboleth-idp]# | ||
| + | |||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | "Jeh PROC" | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== idp v4 logs ==== | ||
| + | |||
| + | < | ||
| + | 2022-05-02 22: | ||
| + | </ | ||
