IDP Attribute Query

[Cantor, Scott]

On 2/24/12 12:34 PM, "James Drews" <drews at engr.wisc.edu> wrote:
>
>I've got the SP correctly authenticating to the first IDP, and it also
>issues a query to the second IDP with the PVI it got from the first.

With the aggregation plugin, I assume? Just clarifying.

>So, I'm pretty sure I need to define a new <PrincipalConnector...> in
>the attribute-resolver.xml file like:

Yes.

><resolver:PrincipalConnector xsi:type="Transient"
>xmlns="urn:mace:shibboleth:2.0:resolver:pc" id="saml1pvi"
>         nameIDFormat="urn:oid:1.3...." />

Not of that type. You need to build your own plugin to do this, and then
have it respond to that format.

>But that obviously isn't enough. I have a DB table (not the StoredID one
>that has a Shib plugin for) that I can translate the PVI I get into the
>principalName that the second IDP can fetch all the attributes from.

Yes, that's the piece you have to write.

-- Scott