REMOTE_USER

[JF]

Scott

Thankyou for the replies and bearing with these questions….

If I translate your answer into config would you be so kind as to confirm (or correct!) my understanding:

1) Well, you need to define an attribute definition that establishes the
value in some way based on the requestContext.principalName data. There is
no such thing as "username" in SAML, you have to encode it into some
Attribute, such as eduPersonPrincipalName, or as a SAML NameID in some
custom format.

This I do in the IdP in attribute-resolver.xml and use eduPersonPrincipalName.  The config at the moment shows:

    <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonPrincipalName" scope="scopehere.com" sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" />
    </resolver:AttributeDefinition>

Is there a way I can set this to the value the user typed into the username field (which I believe SAML calls principal?) without having to of to an external LDAP/DB to retrieve?

2) Then you need to release the relevant attribute ID within the IdP to the
SP.

This I do in attribute-filter.xml I believe: ( I know this will release to all SPs but this will do for now)

    <!--  Release the transient ID to anyone -->
    <afp:AttributeFilterPolicy id="releaseeduPersonPrincipalNameToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="eduPersonPrincipalName">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

The on the IDP I have to do nothing as it will map eduPersonPrincipalName to REMOTE_USER?


Does that look right?



JF

On 15 May 2013, at 19:59, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> And I should have noted, if you just use eduPersonPrincipalName, then
> there's nothing to do on the SP side, that's all done by default.
> 
> But nothing can define EPPN for you, you have to generate it as
> appropriate, be it directly from the username and adding the scope, or
> pulling it from LDAP, or whatnot.
> 
> -- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130515/babbc69e/attachment.html