releasing epTID within the Subject and AttributeStatement simultaneously

[Glenn Wearen]

This works pretty well, in fact, I can skip the filtering step if the
metadata of my SP's support only one of the two nameid formats.
Thanks
Glenn

HEAnet Ltd. Ireland's Education and Research Network 
Registered in Ireland, no 275301.
5 Georges Dock, I.F.S.C. Dublin 1, Ireland. Tel +353 1 6609040.
Availability...
Keep up to date on with Edugate developments on edugate.ie






-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Chad La Joie
Sent: Wednesday, August 10, 2011 1:28 PM
To: Shib Users
Subject: Re: releasing epTID within the Subject and AttributeStatement
simultaneously

Actually, this is pretty easy.  I'm going to assume that your current
ePTID definition is encoding information in the proper format (that
is, as a NameID as the attribute value).

First, define a new simple attribute definition that relies on the
StoredID data connector.  Second, attach SAML 1 and/or 2 string name
identifier encoders to it.  Third, create an attribute filter policy
that releases that attribute to the entities you wish it to go to.
Lastly, either adjust your filter policy such that no other attributes
that are encoded to subject name identifiers (e.g., transient IDs) is
released to that same entity.

On Wed, Aug 10, 2011 at 07:43, Glenn Wearen <glenn.wearen at heanet.ie> wrote:
> Hi,
>
> I use the StoreID dataconnector to create an opaque value that is then
used
> in my epTID attribute definition, the epTID is being released within the
> AttributeStatement of my IdP's responses.
>
> Now, I want to put the same value into Subject part of the response,
whilst
> continuing to include the same value in attribute statement.
>
>
>
> What's the best way to do this?
>
>
>
> Will my attribute filter policy only apply to the attribute statement, or
> will it also apply to the subject statement?
>
>
>
> Regards
>
> Glenn
>
>
>
>
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net