scoped NameID SAML subject

[Cantor, Scott]

On 8/28/14, 5:48 PM, "David Bantz" <dabantz at alaska.edu> wrote:

>Attempting to build a NameID in the SAML subject to meet a vendor
>requirement.
>The following uses and inserts the right identifier, but despite being
>based on ePPN, 
>appears in the SAML assertion subject un-scoped: If ePPN is
>george at my.domain <mailto:george at my.domain>, this
>uses the NameID of george in subject portion of the SAML.  To meet vendor
>requirement,
>I need the scoped value george at my.domaim.  Is there a simple way to do
>that?

Not simple, you'd have to get an attribute defined that's string-valued
with both parts included, and attach the encoder to that. Basically what
you'd do with mail.

I fixed this in v3 when the new portion of the IdP is used to generate
NameIDs instead of the resolver.

-- Scott