Customize Name Identifier format

Question

question

Rahul-7230 asked May 22, '20 AlexPereira-5811 published Jun 5, '20

Customize Name Identifier format

Hi team,

Need some advise here. How to configure name identifier format in Azure AD for SAML ?

I'm looking specific to Transient NameID. As per the Reference1 doc it says it's supported but how to configure it ?

Reference1: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization#nameid-format

As per Reference2: https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol#nameidpolicy

It still shows urn:oasis:names:tc:SAML:2.0:nameid-format:transient: Azure Active Directory issues the NameID claim as a randomly generated value that is unique to the current SSO operation. This means that the value is temporary and cannot be used to identify the authenticating user.

How to generate this specific NameID ?

azure-active-directory

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Rahul-7230 · May 22, 2020 at 09:03 PM

Anyone who has previously done or setup Transient Nameid in AzureAD Saml ?

0 ·

Answer 1 · 2020-05-22T17:58:05.363Z

JaiVerma-7010 answered May 22, '20 AlexPereira-5811 commented Jun 5, '20

What Azure AD is doing expected.

As per OASIS transisnt name identifier - Relying party should generate temporary value

8.3.8 Transient Identifier
URI: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
Indicates that the content of the element is an identifier with transient semantics and SHOULD be treated
as an opaque and temporary value by the relying party. Transient identifier values MUST be generated in
accordance with the rules for SAML identifiers (see Section 1.3.4), and MUST NOT exceed a length of
256 characters.

There may be use cases for using transient name id , specailly where you do not want identity of your user to be expose to application. For example, you federate with library, all you want that a token sign by your IdP and do not mention who from your is trying to access. In such case value of NameID should be different. So what is your case? Why your SAML request is asking for transient nameid format?

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Rahul-7230 · May 22, 2020 at 08:56 PM

@JaiVerma-7010 : Application require name identifier of TRANSIENT type.

I want to know how to configure or setup the NameId as TRANSIENT as MS docs says it’s supported by Azure AD.

How do we configure it in Azure AD if it’s supported ?

You must have read the doc how to customise the nameid in saml sso from drop down in Azure AD. In drop down it’s not showing TRANSIENT option. How to configure it ?? What should be the nameid if application needs Name Identifier as TRANSIENT

Any guidance to it ?

0 ·

Rahul-7230 · May 22, 2020 at 09:08 PM

If relying party is sending the temporary value then what should be the setting in AzureAD end ?

What should be the configuration at Azure AD side ?

0 ·

AlexPereira-5811 · Jun 05, 2020 at 07:54 PM

And what is the number of characters when using transient nameID? Not yet clear.

0 ·

Answer 2 · 2020-05-23T01:36:01.177Z

JaiVerma-7010 answered May 23, '20 JaiVerma-7010 commented May 23, '20

As mentioned that there is no configuration possible on AAD side. All you need to do is let you SP request nameid format as transient in SAML request.

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Rahul-7230 · May 23, 2020 at 08:32 AM

@JaiVerma-7010 : Ok what needs to be configured in Azure AD SAML SSO configuration for Name ID value.

I can't delete or remove the claim it's a required field (Name ID). If this mismatch it might cause an error.

What to configure here in Azure AD this is a mandatory field while configuring SAML SSO ?

0 ·

saml-configuration-2.png (7.5 KiB)

saml-configuration.png (16.5 KiB)

Rahul-7230 Rahul-7230 · May 23, 2020 at 08:43 AM

If SP is requesting TRANSIENT NameId ? And Azure AD uses Email NameId or Default NameId value doesn't allow it to empty or null field configured on Azure AD side what happen then ?

It will be ignored or other way round mismatch in NameID will cause an error ?

@JaiVerma-7010 : Can you comment here ?

0 ·

JaiVerma-7010 Rahul-7230 · May 23, 2020 at 10:37 AM

You need to ask your SP or ask them for sample request they are going to send. NameID is optional in Authn request and it is absolutely work fine if SP do not send anything in request, it still should not fail

0 ·

Answer 3 · 2020-05-23T10:34:10.123Z

JaiVerma-7010 answered May 23, '20

I have not tested but my understanding, based on theory and logic, it should not fail and Azure AD should issue a random value.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2020-06-05T19:52:09.15Z

AlexPereira-5811 answered Jun 5, '20 AlexPereira-5811 published Jun 5, '20

Hi,
I was not able to find the number of characters generated by Azure AD when using the transient nameID.

Any clues?

Thank you.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question