Attribute IDs containing Dashes & Resolver Script

[Cantor, Scott]

On 9/9/13 12:02 AM, "Patrick Rynhart" <P.Rynhart at massey.ac.nz> wrote:

>I'm attempting to federate with an SP where they are expecting an
>attribute to be called "unscoped-affiliation" (an id containing dashes).

No, they're not. That's a Shibboleth internal default name for an
attribute on the SP, it has nothing to do with what you have to send them.

> 
>I am attempting to construct my resolver (in attribute-resolver.xml) as
>follows:

You are needlessly coupling your IdP's internal naming of attributes with
the SP's.

You can, but you certainly don't need to.
>
>If I remove the dashes (and call my variable unscopedaffiliation) then
>things work, but obviously the SP is expecting unscoped-affiliation.

No, it's not. They're asking for the eduPersonAffiliation attribute, which
has a standard URI name, the specifics of which I'm not about to look up,
but is present in both SP and IdP files by default as an example.

-- Scott