ExternalAuth confusing

[Cantor, Scott]

On 4/7/13 11:05 PM, "dominic" <apchee.chen at gmail.com> wrote:

>  /  <resolver:AttributeDefinition xsi:type="PrincipalName"
>xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="UserEmail" /> /

You have no encoders attached to the attribute definition, so there's no
possible way for it be passed to the SP. Please follow the examples in the
file and the documentation on adding attributes. You also need to know
what your goal is. Are you trying to pass an attribute or a NameID in the
subject? The documentation covers both cases. If you want an attribute,
use the existing attribute definition for "mail" or "email". If you want
to use the PrincipalName attribute plugin for it, just change the xsi:type
in the example to that.

>Added one attribute with UserEmail id.

No, you added nothing becasue you've not encoded it, so it's ignored. Your
log will show this at the IdP, and will note that it's been skipped for
inclusion in the response.

>attribute-filter.xml

That part is fine, if you had actually made it encodeable into SAML.

>but I don't know how to edit attribute-map.xml(SP). I don't know how to
>follow the format of name of Attribute. below snippet is existing
>attribute-map.xml:

Well, you have to know how it's been encoded and then create a rule for it
with the appropriate attribute name. Or you could simply reuse a standard
attribute name as shown in the various files. There's one for "mail"
already. Uncomment it in the SP, and then use the proper encoded name in
the IdP and it will just work.

-- Scott