Question about attribute-map.xml

[Ken Weiss]

I'm happy to report that I have my Shibboleth SP working now. Many thanks
to Scott Cantor for his advice. However, I ran across something that
seemed odd, and was wondering if anyone could shed some light on it for me.

I needed to get the 'mail' attribute into my session, so I went into the
attribute-map.xml file and added/uncommented these lines:

    <Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
    <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>

I restarted Apache and shibd, cleared my cookies, and reauthenticated, but
the mail attribute did not appear in my session. So I added
AttributeDecoder lines to attribute-map.xml, like this:


    <Attribute name="urn:mace:dir:attribute-def:mail" id="mail">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>

That worked, but I don't know why.

I looked at another Shibboleth SP that was set up over a year ago by my
predecessor, and the attribute-map.xml file only has the Attribute
statements, without the AttributeDecoder elements, but it works. I
searched for similar configurations on the Internet, and every single
example I found looked like the first case, with no AttributeDecoder
elements.

I have this working, so it's not exactly a high priority, but I would
really like to better understand what's going on here. Why does my SP
require that I include the AttributeDecoder, when other SPs apparently
don't? Any thoughts?

--Ken
------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612