Shibboleth IdP v3 beta 1 Salesforce.com Integration

[Cantor, Scott]

On 12/5/14, 7:34 PM, "Gary Gwin" <ggwin at cafesoft.com> wrote:
>
>How do I include the canonical username the SAML response Subject?

It's not really documented yet, like most things, and what is there isn't 
updated since alpha2 or so. [1]

You can do it the old way by encoding an attribute in the resolver, which 
is documented in the old docs, or you can do it the new way. Either way 
requires defining an AttributeDefinition in the resolver to expose 
whatever the value needs to be.

The old way, you attach a special AttributeEncoder to that 
AttributeDefinition. The new way, you uncomment the bean in 
saml-nameid.xml called shibboleth.SAML2AttributeSourcedGenerator, set the 
format appropriately to whatever it needs to be, and tell it what 
attribute(s) to pull the value from.

You still have to trigger that either with a NameIDFormat in the metadata, 
or a setting in relying-party.xml for a specific RP definition.

I believe SalesForce supports pulling the username from a SAML Attribute. 
That is the better choice in general. Shibboleth does not want you to use 
NameIDs and it is never the easiest route.

-- Scott

[1] 
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfig
uration