IDP Attribute Query

[James Drews]

Problem: I'd like to have an SP auth to one IDP, and get additional 
attributes from a second IDP. The two IDP's don't share a common eppn, 
but they DO share a common attribute (let's just call it PVI for public 
identifier).

I've got the SP correctly authenticating to the first IDP, and it also 
issues a query to the second IDP with the PVI it got from the first.

My problem is the second IDP doesn't know how to deal with the query:
Error resolving principal name for SAML request
Cause: No principal connector available to resolve a subject name with 
format urn:oid:1....

So, I'm pretty sure I need to define a new <PrincipalConnector...> in 
the attribute-resolver.xml file like:

<resolver:PrincipalConnector xsi:type="Transient" 
xmlns="urn:mace:shibboleth:2.0:resolver:pc" id="saml1pvi"
         nameIDFormat="urn:oid:1.3...." />

But that obviously isn't enough. I have a DB table (not the StoredID one 
that has a Shib plugin for) that I can translate the PVI I get into the 
principalName that the second IDP can fetch all the attributes from.

Any thoughts?

James


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 9405 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20120224/695def85/attachment.bin