Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docpublic:systemes:persistentnameid [2018/04/09 10:03] procacci@tem-tsp.eu [saml-nameid.xml] |
docpublic:systemes:persistentnameid [2022/05/03 08:20] (current) adminjp [idp v4 logs] |
||
|---|---|---|---|
| Line 44: | Line 44: | ||
| then we need to uncommented // <ref bean=" | then we need to uncommented // <ref bean=" | ||
| + | |||
| + | === idp v4 === | ||
| + | |||
| + | quite the same as in V3 , except here we choose mail attribute and validate advice to use BASE32 encoding | ||
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim saml-nameid.properties | ||
| + | idp.persistentId.algorithm = SHA | ||
| + | idp.persistentId.salt = secretpasslongenough16bytes | ||
| + | idp.persistentId.sourceAttribute = mail | ||
| + | idp.persistentId.useUnfilteredAttributes = true | ||
| + | idp.persistentId.encoding = BASE32 | ||
| + | |||
| + | idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator | ||
| + | </ | ||
| Line 78: | Line 93: | ||
| cf metadata below | cf metadata below | ||
| - | ===== metada requesting persistendID | + | |
| + | === idp v4 === | ||
| + | |||
| + | uncomment bean=" | ||
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim saml-nameid.xml | ||
| + | |||
| + | <!-- SAML 2 NameID Generation --> | ||
| + | < | ||
| + | |||
| + | <ref bean=" | ||
| + | |||
| + | <!-- Uncommenting this bean requires configuration in saml-nameid.properties. --> | ||
| + | <ref bean=" | ||
| + | </ | ||
| + | ==== metada requesting persistendID ==== | ||
| example | example | ||
| Line 133: | Line 164: | ||
| </ | </ | ||
| + | === resolver idp 4 === | ||
| - | ==== test / validate with aacli ===== | + | xml syntaxe changes sligthly : |
| + | |||
| + | < | ||
| + | [root@idp4 conf]# vim attribute-resolver-ldap.xml | ||
| + | |||
| + | < | ||
| + | < | ||
| + | nameIdFormat=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | excludeResolutionPhases=" | ||
| + | generatedAttributeID=" | ||
| + | salt=" | ||
| + | algorithm=" | ||
| + | encoding=" | ||
| + | |||
| + | < | ||
| + | |||
| + | </ | ||
| + | </ | ||
| + | |||
| + | ===== test / validate with aacli ====== | ||
| + | |||
| + | aacli.sh is a script that allows us to test locally what the IDP with send as nameIDs and attributes for a specific SP and associated principal (login) . we tes here our persistendID requested by SP and eduPersonTargetedID required : | ||
| < | < | ||
| Line 200: | Line 260: | ||
| </ | </ | ||
| + | === aacli idp v4 === | ||
| + | |||
| + | < | ||
| + | [root@idp4 shibboleth-idp]# | ||
| + | |||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | "Jeh PROC" | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== idp v4 logs ==== | ||
| + | |||
| + | < | ||
| + | 2022-05-02 22: | ||
| + | </ | ||
