H2 enrich external IdP information with internal attributes

[Cantor, Scott]

On 1/28/13 7:33 PM, "Demin Olivier" <Olivier.Demin at generali.be> wrote:

>From what I understood, I need to configure my SP with:
>-         
>An SSO profile with the External IdP
>-         
>And an AttributeQuery profile with my internal IdP in order to enrich the
>attributes received from the external IdP with internal attributes (the
>internal idp queries my user repository based on the external id to
>retrieve internal attributes)

You can do that with a Shibboleth SP, yes. It's a bit unusual, but it's a
straightforward combination of the features it has. Assuming that your
internal attribute authority (IdP) has the mappings from the external IdP
usernames to your internal data. That's the main thing you have to have to
do this with SOAP queries, one of the two IdPs has to know how to
crosswalk between the namespaces.

> 
>Am I on the right track?  If not, is what I need to do possible with
>Shibboleth and how?
> 
>Would anybody have some example Shibboleth config files for the SP and
>IdP for similar configuration?  Or point me to some documentation that
>would help me realize this?  I haven¹t been able to configure this until
>now with the Shibboleth wiki pages.

You have to configure your IdP to support queries based on a username from
the other IdP. That usually means a PrincipalConnector of type "Direct",
see Accepting the Name Identifier under
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

You have to define a SAML NameID format to use that will correspond to
this piece of data, and then map that via the PrincipalConnector so that
it can be turned into a principalName inside the resolver for use in the
data connectors. The best thing to use is the unique name of the attribute
supplied by the external IdP. If the name it supplies is bogus or not a
URI suitable for a NameID Format then you'll have to define something.

The query itself is trivial, you configure something like this in the SP:

<AttributeResolver type="SimpleAggregation" attributeId="user_id"
	format="https://example.com/userid">
    <Entity>https://example.edu/idp/shibboleth</Entity>
</AttributeResolver>


format is the NameID format to use matching the PrincipalConnector and
Entity is the name of your IdP.

-- Scott