Providing attributes from CAS

[Cantor, Scott]

On 4/8/13 1:16 PM, "Stein, Eric" <steine at locustec.com> wrote:

>I'm still not sure how to get at the username that Shibboleth IdP is
>putting in by default. It's not in any of the request header information
>that I can see .. how do I access it from an SP?

You have to define resolver behavior at the IdP to put that into an
attribute or a SAML NameID and then extract it on the SP end.

No, it's not going to show up automatically, that's a major difference
between a non-federated system in which a local username is just
intrinsically obvious and a federated system where it wouldn't be.

The typical Shibboleth community attribute for a username of the normal
sort is eduPersonPrincipalName, but there are others, and there's the
approach of just sticking it into a "uid" attribute for bilateral use, or
using the SAML NameID construct.

-- Scott