...
Code Block | ||||||
---|---|---|---|---|---|---|
| ||||||
<resolver:AttributeDefinition id="persistentId" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeIdsourceAttributeID="storedId"> <resolver:Dependency ref="StoredId"/> <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /> </resolver:AttributeDefinition> <resolver:DataConnector xsi:type="StoredId" xmlns="urn:mace:shibboleth:2.0:resolver:dc" id="StoredId" sourceAttributeID="uid" salt="kd89lkalkcv2f09fjs3v981298fkfjkgri"> <resolver:Dependency ref="ldap" /> <!-- database connection settings go here --> </resolver:DataConnector> |
Note |
---|
The name format for a persistent ID in SAML 1 and 2.0 is |
Release the Attribute
Finally, define an attribute filter policy that releases the persistent ID to the intended relying parties. Since persistent IDs are opaque, and thus not personally identifiable, they are safe to release to anyone. Therefore the following attribute filter policy is suggested but others may be used at the deployer's discretion.
...