Combining a ResolverTemplateAttributeDefinition with a SAML2StringNameID element

[Karla Borecky]

Hello,

I am working with an outside vendor on setting up a hosted SP to talk to
our IdP. After much wrangling, we have it working. I'm releasing email
address as the source attribute for a NameID, encoded as SAML2StringNameID,
type of emailAddress.

The problem is, some of the people who use this service don't get email
accounts from us--only LDAP accounts. (It used to be authenticated with
LDAP.)  I am loathe to put their non-Smith email addresses in the "mail"
attribute of these accounts, since those addresses are outside our domain.

Since this service is only using the email address as a unique identifier,
I thought of using eppn as the nameID -- but I understand now that scoped
attributes don't exist in their final @SCOPE format within the
attribute-resolver.

So I am thinking of creating a resolver template attribute definition. I
believe I understand how to do that piece, but I'm wondering about then
using the resulting attribute for a NameID release. If it's possible to do
this, then I have a few questions:

1. The sourceAttributeID for the nameID definition would be the ID listed
in the attribute definition template, yes? (bold and red in example below):

<resolver:AttributeDefinition xsi:type="Template"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              id="*UNIQUE_ID*">

...and the attribute definition template would have to precede the nameID
section...? (or no?)

3. Can I leave my nameid-format at this:


nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

since the end product will be in the general format of an email address? or
should I use

nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

(which is what our Gmail definition uses)? I would tend to think
"unspecified" would be the one to use, since I'm basically making this
attribute up.

4. The SP has "emailAddress" as the nameid format in their metadata as
well, so I assume whatever I use (emailAddress or unspecified), they would
use, yes?

5. Would they put my nameID attribute as the FriendlyName of the attribute
in this section:

<md:RequestedAttribute FriendlyName="mail"
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"/>

or the attribute definition template one (red and bold, in the example
above)? Since they aren't using my current NameID attribute
("mailasNameID"), I'm unclear on this.

---
Or...instead of having two separate chunks, could I create some monstrously
complicated AttributeDefinition block that would do all of this in one fell
swoop?

Sorry to have so many questions... I really appreciate your help.

Thanks!
Karla B

-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130905/1ea1fd8e/attachment.html