urn:mace:dir:attribute-def:eduPersonTargetedID only username part not scope

Peter Schober peter.schober at univie.ac.at
Wed Oct 17 08:29:21 EDT 2012


* damian.hall at canterbury.ac.uk <damian.hall at canterbury.ac.uk> [2012-10-17 14:06]:
> Claim issued:   issue(Type =
> "urn:mace:dir:attribute-def:eduPersonTargetedID", Value =
> "test at mydomain.ac.uk")

I doubt you can make MS ADFS interop with Shibboleth using SAML1.x --
the above attribute name is not legal to use with SAML2, Cf. the
MACE-Dir SAML Attribute Profiles:
http://middleware.internet2.edu/dir/docs/internet2-mace-dir-saml-attributes-200804.pdf

> When shibboleth receives this using the;
> 
>    <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
> id="targeted-id">
> 	<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>

I could only repeat myself. Read the documentation I pointed you to.
This is not a "scoped attribute" in the sense that
eduPersonScopedAffiliation is (or eduPersonPrincipalName).

> Could you give an example as to how I could just extract the <test> part
> from the attribute, if this isn't the correct attribute to use 
> to achieve this could you indicate what I should be using.

Read the definition and purpose of the attribute eduPersonTargetedID,
I sent you the link. It makes no sense for me to repeat all that here.

If all you want is a username (and don't care about global uniqueness,
opaqueness, targeted/pair-wise identifers or qualifiers), you can just
as well use the uid attribute:
http://tools.ietf.org/html/rfc4519#section-2.39
-peter


More information about the users mailing list