Salesforce error when authing against Shibboleth

[Cantor, Scott]

On 8/8/14, 7:17 PM, "Ben Branch" <BBranch at uco.edu> wrote:

>Okay,  just to be sure I understand this correctly.  The attributeID that
>is used in the attribute-filter needs to match the id that is used in the
>attribute resolver?  eg.  <resolver:AttributeDefinition
>xsi:type="ad:Simple" id="email"> needs to be <afp:AttributeRule
>attributeID="email">?

Yes. The term Attribute in the filter refers to what we informally call
IdP Attributes, the internal results of the attribute definitions.

The raw output of data connectors aren't used except within the resolver
configuration, they don't make it out of that layer. When you use LDAP,
those are actually LDAP attributes which adds confusion #1.

What you encode in the resolver's definitions, if the IdP attribute is
release by a filter rule, turn into SAML Attributes or SAML NameIDs.
That's the second confusing use of the term "attribute".

There just aren't any good words for "attribute" except for attribute.

-- Scott