REMOTE_USER definition question

[Cantor, Scott]

> It says “The first one found….”,. but if I only have REMOTE_USER="eppn
> persistent-id targeted-id" and the IDP is sending uid (which is not here),
> how is it appearing in the logs and functioning as if it was listed there?

It wouldn't, so one of your assumptions there is not in fact true.

> Is it because the fields listed in REMOTE_USER  are just placeholders and as
> long as the attribute-map.xml has the matching definition for what is being
> sent, it will populate the variable even though the name is different?

No.

> The reason I am asking this is the IDP admin is changing the name of the
> attribute she is sending from uid to sysid.  I do not know if the underlying
> value is changing or just the name (she doesn’t communicate stuff to me).
> If she is actually sending uid but just wants to call it sysid, should I
> just change "name=" or "id=" to sysid?

You are confusing your name with theirs. What you call it is up to you. If they change the name on the wire, then you need to create or adjust a mapping rule as you see fit.

When you're dealing with different attribute names that internally are all collapsed into one conceptual data element for your purposes, the best thing is to map all the external names to a new/different local name that reflects its local nature. Otherwise you're confusing matters by calling three different external attributes "uid" and then confusing "uid" with the externally named attribute "uid" as opposed to your imposed name.

REMOTE_USER  may be the best way to do that or a custom attribute ID might serve better, it just depends.

-- Scott