REMOTE_USER

[Cantor, Scott]

On 5/15/13 2:53 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 5/15/13 2:04 PM, "James Forrest" <jamesforrest56 at gmail.com> wrote:
>
>>Would somebody please be kind enough to walk me through the steps
>>required to  pass the authenticated username (as input by the end user)
>>through from the IdP and the Sp to Apache.
>
>Well, you need to define an attribute definition that establishes the
>value in some way based on the requestContext.principalName data. There is
>no such thing as "username" in SAML, you have to encode it into some
>Attribute, such as eduPersonPrincipalName, or as a SAML NameID in some
>custom format.

And I should have noted, if you just use eduPersonPrincipalName, then
there's nothing to do on the SP side, that's all done by default.

But nothing can define EPPN for you, you have to generate it as
appropriate, be it directly from the username and adding the scope, or
pulling it from LDAP, or whatnot.

-- Scott