different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 1/15/13 1:15 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:

>I'm using JNDI in server.xml as the guide suggests:

If the guide is some piece of our documentation, it's not a guide, it's
merely an example. Your environment is your own and only you can assess
what needs to be done in your environment.

><Realm className="org.apache.catalina.realm.JNDIRealm"

That's Tomcat. If their documentation isn't sufficient, I'd suggest
checking with them on the behavior of that code. If you want to avoid the
problem, I suggest switching to the JAAS Realm, because that can reuse the
same configuration as the IdP can use. That guarantees consistency.

In short, that's the reason you're having the problem.

>If I well understand, I'm using a different authentication mechanism for
>ECP and WEB, but I can't find what I should change in the IDP
>(attribute-resolver.xml? attribute-filter.xml? server.xml?
>login.config?), in order to get the same information in the ECP assertion.

If you want to get both of them expressing the principal the same way,
then you need to go look at the Tomcat documentation for JNDI realm or
change to JAAS. If you want the resolver to handle either form, then you
need to fix your resolver queries as appropriate. The lookups are not
hidden from you, you have to configure them in your data connector(s).

-- Scott