IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Sun October 05, 2025 08:12 PM

    Hi,

    We have a requirement to update NameID value in below SAML assertion, I configured Verify Access (on-prem) as IDP with persistent nameid format. 

    In SAML mapping rule, I tried to set principalName to one of LDAP custom attributes instead of auto-generated id ie. uuid2d5cd167-0198-1990-82f3-33df4fc59bnm

    stsuu.setPrincipalName(nameID);

    But it is not working, what is the best way to populate nameid subject value with ldap attribute? (for example set employeeUniqueId in NameID value)

    as-it-is SAML assertion:

    <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://<fqdn>/isam/sps/demo-idp/saml20" SPNameQualifier="https://<sp-fqdn>" >uuid2d5cd167-0198-1990-82f3-33df4fc59bnm</saml:NameID>

    Expected SAML assertion:

    <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://<fqdn>/isam/sps/demo-idp/saml20" SPNameQualifier="https://<sp-fqdn>" >empId1234</saml:NameID>

    Thanks for your support.



    ------------------------------
    Someswara Reddy Karem
    ------------------------------


  • 2.  RE: IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Mon October 06, 2025 02:08 AM

    Hi,
    Try the below :

    // Import the STS Attribute class
    importPackage(Packages.com.tivoli.am.fim.trustserver.sts.uuser);

    // 1. Extract the LDAP attribute from the STS-UU.
    //    Replace "employeeUniqueId" with the actual attribute name in your LDAP schema.
    var empIdAttr = stsuu.getAttributeList().getAttribute("employeeUniqueId");
    if (empIdAttr == null || empIdAttr.getValues().length == 0) {
        // No value found; default to existing principal name
        var existing = stsuu.getPrincipalName();
        empId = (existing != null) ? existing : "";
    } else {
        // Use the first value of the LDAP attribute
        var empId = empIdAttr.getValues()[0];
    }

    // 2. Add a Principal attribute of persistent NameID format
    var nameIdFormat = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
    stsuu.addPrincipalAttribute(
        new Attribute("principalName", nameIdFormat, empId)
    );

    // Optionally override the SPNameQualifier or NameQualifier via context attributes:
    // var spQualifier = "https://<sp-fqdn>";
    // stsuu.addContextAttribute(
    //     new AttributeAssertion("ChangeSPNameQualifier", "urn:oasis:names:tc:SAML:2.0:assertion", spQualifier)
    // );



    ------------------------------
    Mohamed Ahmed
    ------------------------------

    Original Message


  • 3.  RE: IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Mon October 06, 2025 07:28 AM

    Hi Mohamed,

    Thanks for your prompt reply. I tried your proposed solution, but it is not working, still it shows auto-generated uuid value.
    From federation logs, I noted that NameID is part of <stsuuser:RequestSecurityToken> from stsuu object as below,  so stsuu.addPrincipalAttribute() mayn't work to replace NameID value.

    <stsuuser:RequestSecurityToken>

    </stsuuser:Attribute><stsuuser:Attribute name="Claims" type="com:tivoli:am:fim:sts:RST"><stsuuser:Value><wst:Claims Dialect="urn:ibm:names:ITFIM:saml" xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust"><fimc:Saml20Claims xmlns:fimc="urn:ibm:names:ITFIM:saml" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" AssertionConsumerServiceURL="<sp_acs_url>" AttributeConsumingServiceIndex="0" DefaultNameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" LoginOccurred="true" MustSignAssertion="true" ProtocolProfile="urn:oasis:names:tc:SAML:2:0:profiles:SSO" RequestedNameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" SessionIndex="uuidd0212ece-c6a8-4ac3-b5b8-767b60cf3431" SessionNotOnOrAfter="2025-10-06T11:59:48Z" Target="<SP_Target_url>"><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://<fqdn>/isam/sps/demo-idp/saml20" SPNameQualifier="<SP_Identifier>">uuid1d3cd177-0198-1920-82f3-83df4fc59bac</saml:NameID></fimc:Saml20Claims></wst:Claims></stsuuser:Value>

    Thanks
    Regards
    SK



    ------------------------------
    Someswara Reddy Karem
    ------------------------------

    Original Message


  • 4.  RE: IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Mon October 06, 2025 03:40 AM

    Hi,

    If the SAML request contains nameid-format:persistent,

    stsuu.setPrincipalName(nameID) does not have any effect.

    IVIA will use the alias present in the ALIAS_SVC_ALIASUSERPARTNER table or generate a random alias if not found.



    ------------------------------
    Stéphane MASSON
    ------------------------------

    Original Message


  • 5.  RE: IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Mon October 06, 2025 07:32 AM

    Hi Stephane, 

    Thanks for your prompt response,  we don't want auto generated random value. do you know how to replace it with another claim??

    Regards
    RK



    ------------------------------
    Someswara Reddy Karem
    ------------------------------

    Original Message


  • 6.  RE: IBM Verify Identity Access - Set subject claim in Persistent nameid format

    Posted Tue October 07, 2025 05:07 AM

    Hi Someswara,

    I'm not sure at which point in the flow the alias lookup is done, but you could try to call the alias service in the access policy to set it to the value you want. With a bit of luck, that's before the automatic lookup.

    Kind regards,



    ------------------------------
    Laurent LA Asselborn
    ------------------------------

    Original Message


Related Content