generating attribute from other attribute in SP

[Flannery, Sean]

Thanks Peter,

1) 

> in attribute-map.xml:
>     <!-- this is the real attribute that comes back from the IDP -->
>     <Attribute name="user-unique" id="user-unique" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />
>     <!-- this is the generated attribute, built from user-unique -->
>     <Attribute name="user-dn" id="user-dn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />

Why put user-dn in the attribute-map if it will never be coming from
the IdP (i.e., there's nothing to map it from)? Try removing that.


* If I don't have it in attribute-map its not set in the header.  If I do include it in attribute-map , its at least set, just with an empty value.  So that's why I have it included, though I agree it doesn't look like it should be necessary.

2) Here's the example from the documentation:

  <Template>$givenName $sn</Template>

So I'd lose all the double quotes and spurious whitespace, like:

  <Template>id=$user-unique,ou=people</Template>

double quotes and spurious whitespace are a future goal, right now I just have it as,

<AttributeResolver type="Template" sources="user-unique" dest="user-dn">
    <Template>$user-unique</Template>
</AttributeResolver>

So it should be setting it to the same value as user-unique.  Yet, in the session user-unique is SFlannery01 while user-dn is empty.

But when I eventually get the basic AttributeResolver working, I will try with your suggestion for building the string (no quotes and white spaces).

Thanks again for help


________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Monday, August 12, 2013 10:50 AM
To: users at shibboleth.net
Subject: Re: generating attribute from other attribute in SP

* Flannery, Sean <sean.flannery at jwt.com> [2013-08-12 17:31]:
> need: generate attribute user-dn from user-unique
>
> this is how I have it implemented
>
> in attribute-map.xml:
>     <!-- this is the real attribute that comes back from the IDP -->
>     <Attribute name="user-unique" id="user-unique" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />
>     <!-- this is the generated attribute, built from user-unique -->
>     <Attribute name="user-dn" id="user-dn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />

Why put user-dn in the attribute-map if it will never be coming from
the IdP (i.e., there's nothing to map it from)? Try removing that.

> Secondly, though I'm just trying to get the AttributeResolver to
> work at this point, I'll eventually need to combine the value of
> user-unique with a String literal but don't see syntax examples.
> Any idea if this would work,
>
> <AttributeResolver type="Template" sources="user-unique" dest="user-dn">
>     <Template>"id=" $user-unique ",ou=people"</Template>
> </AttributeResolver>

Here's the example from the documentation:

  <Template>$givenName $sn</Template>

So I'd lose all the double quotes and spurious whitespace, like:

  <Template>id=$user-unique,ou=people</Template>

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net