releasing epTID within the Subject and AttributeStatement simultaneously

[Chad La Joie]

Yes, or if you can use the name id format precedence setting.  The filtering is just the surest way to control it because nothing other than what you specifically type ever enters in to the decision making process at that point.

--
Chad La Joie
www.itumi.biz
trusted identities, delivered

On Aug 11, 2011, at 10:16 AM, Glenn Wearen wrote:

> This works pretty well, in fact, I can skip the filtering step if the
> metadata of my SP's support only one of the two nameid formats.
> Thanks
> Glenn
> 
> HEAnet Ltd. Ireland's Education and Research Network 
> Registered in Ireland, no 275301.
> 5 Georges Dock, I.F.S.C. Dublin 1, Ireland. Tel +353 1 6609040.
> Availability...
> Keep up to date on with Edugate developments on edugate.ie
> 
> 
> 
> 
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
> Behalf Of Chad La Joie
> Sent: Wednesday, August 10, 2011 1:28 PM
> To: Shib Users
> Subject: Re: releasing epTID within the Subject and AttributeStatement
> simultaneously
> 
> Actually, this is pretty easy.  I'm going to assume that your current
> ePTID definition is encoding information in the proper format (that
> is, as a NameID as the attribute value).
> 
> First, define a new simple attribute definition that relies on the
> StoredID data connector.  Second, attach SAML 1 and/or 2 string name
> identifier encoders to it.  Third, create an attribute filter policy
> that releases that attribute to the entities you wish it to go to.
> Lastly, either adjust your filter policy such that no other attributes
> that are encoded to subject name identifiers (e.g., transient IDs) is
> released to that same entity.
> 
> On Wed, Aug 10, 2011 at 07:43, Glenn Wearen <glenn.wearen at heanet.ie> wrote:
>> Hi,
>> 
>> I use the StoreID dataconnector to create an opaque value that is then
> used
>> in my epTID attribute definition, the epTID is being released within the
>> AttributeStatement of my IdP's responses.
>> 
>> Now, I want to put the same value into Subject part of the response,
> whilst
>> continuing to include the same value in attribute statement.
>> 
>> 
>> 
>> What's the best way to do this?
>> 
>> 
>> 
>> Will my attribute filter policy only apply to the attribute statement, or
>> will it also apply to the subject statement?
>> 
>> 
>> 
>> Regards
>> 
>> Glenn
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> 
> 
> 
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net