Attribute IDs containing Dashes & Resolver Script

[Mike Flynn]

name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation"


Use that URI for the name.


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Monday, September 9, 2013 7:02 AM
Subject: Re: Attribute IDs containing Dashes & Resolver Script
 

On 9/9/13 12:02 AM, "Patrick Rynhart" <P.Rynhart at massey.ac.nz> wrote:

>I'm attempting to federate with an SP where they are expecting an
>attribute to be called "unscoped-affiliation" (an id containing dashes).

No, they're not. That's a Shibboleth internal default name for an
attribute on the SP, it has nothing to do with what you have to send them.

> 
>I am attempting to construct my resolver (in attribute-resolver.xml) as
>follows:

You are needlessly coupling your IdP's internal naming of attributes with
the SP's.

You can, but you certainly don't need to.
>
>If I remove the dashes (and call my variable unscopedaffiliation) then
>things work, but obviously the SP is expecting unscoped-affiliation.

No, it's not. They're asking for the eduPersonAffiliation attribute, which
has a standard URI name, the specifics of which I'm not about to look up,
but is present in both SP and IdP files by default as an example.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130909/a626260b/attachment.html