generating attribute from other attribute in SP

[Flannery, Sean]

Hello,

I'm trying to implement the NativeSPAttributeResolver to generate an attribute at the SP level but it sets the attribute as an empty value.  So it is inserting the generated attribute into the session, but it never has a value.

Wondering if I have a syntax error?

need: generate attribute user-dn from user-unique 

this is how I have it implemented

in attribute-map.xml:
    <!-- this is the real attribute that comes back from the IDP -->
    <Attribute name="user-unique" id="user-unique" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />
    <!-- this is the generated attribute, built from user-unique -->
    <Attribute name="user-dn" id="user-dn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />
    
in shibboleth2.xml:

<!-- inside the ApplicationDefaults section -->
<AttributeResolver type="Template" sources="user-unique" dest="user-dn">
    <Template>$user-unique</Template>
</AttributeResolver>

headers after SSO:

HTTP_USER_DN => 
HTTP_USER_UNIQUE => SFlannery01

Any pointers, in terms of possible syntax errors, would be appreciated.  

Secondly, though I'm just trying to get the AttributeResolver to work at this point, I'll eventually need to combine the value of user-unique with a String literal but don't see syntax examples.  Any idea if this would work,

<AttributeResolver type="Template" sources="user-unique" dest="user-dn">
    <Template>"id=" $user-unique ",ou=people"</Template>
</AttributeResolver>

Where $user-unique is inserted into the string "id=XXX,ou=people"

Thanks for your time,

Sean

________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Friday, August 09, 2013 10:15 AM
To: Shib Users
Subject: Re: generating attribute from other attribute in SP

On 8/9/13 11:12 AM, "Flannery, Sean" <sean.flannery at jwt.com> wrote:

>short version: given attribute companyID coming back from the IDP, I need
>the SP to set a related http header value, companyDN, who's value is
>equal to "empid=${companyID},ou=people,dc=com" where ${companyID} is the
>value of the company ID attribute.

Check the Template plugin in the NativeSPAttributeResolver doc page.

>Most the documentation I'm finding seems to show how to do this at the
>IDP level, not the SP.

Yes, I added the plugin in 2.5.

>This is necessary because, as our org moves off an old SSO solution (to
>shibboleth) some of the legacy apps need more time for the adjustment and
>thus I need to setup one of our SPs to generate all the HTTP headers they
>expect.  Our IDP does not expose this
> companyDN attribute, but I could generate it from the companyID
>attribute.

That's the sort of case envisioned, yes.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net