Remove "userid.attribute" about simplesamlphp HOT 7 CLOSED

Hi,
there seems to be an inconsistency in SSP 1.14 regarding userid.attribute:

Setting the attribute for the IdP in saml20-idp-hosted.php already results in warnings:

The 'userid.attribute' option has been deprecated.

OTOH the consent module (consent:Consent) still requires the UserID, see https://simplesamlphp.org/docs/stable/consent:consent

NB: since the consent module is run after attributes are filtered the uid-attribute usually is not and should not be available anymore.

Kind regards, Georg

from simplesamlphp.

Hi @gollmann!

The userid.attribute option has been indeed deprecated, and will be removed in 2.0. That doesn't mean it's no longer in use. It is, in many places, and we'll slowly take it off. It will keep working during 1.14.x as you have seen, and also in 1.15.x, but in the latter there will be alternatives to it for every module or place where it's used.

from simplesamlphp.

@jaimeperez I'm not sure it's useful to start issuing deprecation notices to users if they cannot stop using that configuration setting. Maybe we should just mark it as deprecated in the code?

When the time has come that you indeed do not need to use this option anymore, we'd need to put something in the upgrade notes to tell users what the alternatives are, because that's now also lacking.

from simplesamlphp.

Hi Jaime,
I need help in resolving the error: -
core:TargetedID: Missing UserID for this user. Please check the 'userid.attribute' option in the metadata against the attributes provided by the authentication source
I have done the followings -

1. Setup an IdP
2. Setup an SP
3. Set twitter as the authsource
4. My SP receives response when I do not use authproc, it receives all the authentication data from twitter.
5. But when I try to add filter, it gives me the above error. I made a change in the twitter mapping file - 'twitter.email' => 'uid',
6. What else we need to add in the authsource when we use Twitter:
   'twitter' => array(
   'authtwitter:Twitter',
   'key' => ''.$twitterapikey.'',
   'secret' => ''.$twittersecret.'',
   'force_login' => FALSE,
   'userid.attribute' => 'email',
   'attributes' => array(
   'IDPEmail' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:email',
   ),

Any help will be greatly appreciated.

from simplesamlphp.

Hi @w3care,

This is an issue tracker, not a support forum. Please use the mailing list if you need support.

from simplesamlphp.

The consent-module was taken care of. We picked 'identifyingAttribute' as a config setting

from simplesamlphp.

Closing, because I'm pretty sure all objects and/or authprocs now have the 'identifyingAttribute' available

from simplesamlphp.