Google Apps - an alternative for Principal name

[Prasanna]

Hello All,

Everyone knows that we need Principal Name to authenticate google apps.
Shall we send email address instead of Principal name. If so can anyone
suggest me how to alter the google apps metadata and resolver configuration.
I am trying to give Kerberos for multiple UPN's under same forest. It would
be helpful to authenticate the Google Apps users with email id.

Current Attribute resolver and metadata used,

<EntityDescriptor entityID="google.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
       
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/YOURDOMAIN.COM/acs" />
    </SPSSODescriptor>
</EntityDescriptor>

<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
    <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
        nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/>
</resolver:AttributeDefinition>

<AttributeFilterPolicy>
    <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com" />

    <AttributeRule attributeID="principal">
        <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>
</AttributeFilterPolicy>

Thanks
Prasanna



-----
Prasanna V B
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Google-Apps-an-alternative-for-Principal-name-tp7585334.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.