coordinating an SP with multiple IdPs

[Adam Cohen]

Greetings,
Im working on a new SP implementation which needs to work with multiple IdPs.  The application behind the SP needs a single identifier for the user which it expects to find in the REMOTE_USER http header after authentication.  

The different IdPs are asserting different attributes.  One site uses "uid", another uses "ePPN" and there may be a third.    The value present in any of these attributes will be acceptable to the SP, but I cannot figure out how to tell my SP to map the appropriate IdP attribute name to the REMOTE_USER target.

My best guess was to do it with the <ApplicationDefaults> stanza in shibboleth2.xml: 
 <ApplicationDefaults id="default" entityID="yada yada" policyId="default" signing="false" encryption="false" REMOTE_USER="uid eppn netid" >

but its unclear to me what will happen if an IdP asserted more than one of these values…

It doesn't look like the attribute-map.xml is the right place either - although the asserted attribute has to be defined there for each IdP, there's nothing that seems to establish the connection of the attribute to the http header that is passed to the SP.

Any pointers to documentation or an example of this configuration would be appreciated

-- 
Adam Cohen / IT Manager
Energy Biosciences Institute / UC Berkeley
109 Calvin Lab / 510-642-7709
http://www.energybiosciencesinstitute.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120301/71975299/attachment.html