coordinating an SP with multiple IdPs

[Sharma, Dattathreya]

>>  <ApplicationDefaults id="default" entityID="yada yada" policyId="default" signing="false" encryption="false" REMOTE_USER="uid eppn netid" >

My understanding is,  when IdP asserts more than one, first available (in that order) will be passed in REMOTE_USER.

Datta

From: Adam Cohen <adamcohen at berkeley.edu<mailto:adamcohen at berkeley.edu>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thu, 1 Mar 2012 14:31:32 -0800
To: <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: coordinating an SP with multiple IdPs

Greetings,
Im working on a new SP implementation which needs to work with multiple IdPs.  The application behind the SP needs a single identifier for the user which it expects to find in the REMOTE_USER http header after authentication.

The different IdPs are asserting different attributes.  One site uses "uid", another uses "ePPN" and there may be a third.    The value present in any of these attributes will be acceptable to the SP, but I cannot figure out how to tell my SP to map the appropriate IdP attribute name to the REMOTE_USER target.

My best guess was to do it with the <ApplicationDefaults> stanza in shibboleth2.xml:
 <ApplicationDefaults id="default" entityID="yada yada" policyId="default" signing="false" encryption="false" REMOTE_USER="uid eppn netid" >

but its unclear to me what will happen if an IdP asserted more than one of these values…

It doesn't look like the attribute-map.xml is the right place either - although the asserted attribute has to be defined there for each IdP, there's nothing that seems to establish the connection of the attribute to the http header that is passed to the SP.

Any pointers to documentation or an example of this configuration would be appreciated

--
Adam Cohen / IT Manager
Energy Biosciences Institute / UC Berkeley
109 Calvin Lab / 510-642-7709
http://www.energybiosciencesinstitute.org

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120301/f582556a/attachment.html