coordinating an SP with multiple IdPs

[Adam Cohen]

I see how attribute-map.xml provides names for attributes so they can be dereferenced but it was that later use of the attribute in shibboleth2.xml that was the crux of my question.    

This discussion also led me to another question though: if the IdP's person identifier attribute (say they call it "foo") is not already defined in attribute-map.xml then I would have to add it with its oid or mace format identifier.

Is there anything to prevent me from naming that attribute for my own convenience?   If not, then I could assign my name "eppn" to their oid/mace identifier for the attribute instead of "foo" and then the SP would have my name for the value.   

Then set REMOTE_USER="eppn" in shibboleth2.xml and don't have to worry about which attribute gets selected and possibly getting an unexpected value being sent over to the app.  

-- 
Adam Cohen / IT Manager
Energy Biosciences Institute / UC Berkeley
109 Calvin Lab / 510-642-7709
http://www.energybiosciencesinstitute.org

On Mar 1, 2012, at 4:27 PM, Cantor, Scott wrote:

> On 3/1/12 5:31 PM, "Adam Cohen" <adamcohen at berkeley.edu> wrote:
> 
>> It doesn't look like the attribute-map.xml is the right place either -
>> although the asserted attribute has to be defined there for each IdP,
>> there's nothing that seems to establish the connection of the attribute
>> to the http header that is passed to the SP.
> 
> I'm puzzled by that impression since that is the entire and sole purpose
> of that file.
> 
> That said, REMOTE_USER isn't really a header, and that question was
> answered earlier.
> 
>> Any pointers to documentation or an example of this configuration would
>> be appreciated
> 
> The starting point would be to look up the definition of the REMOTE_USER
> setting in the configuration reference, and you'll find it documenting the
> behavior mentioned by the other poster. Or at least it's trying to, I
> don't recall the exact definition it gives.
> 
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net