X.509 Authentication & How to set principalName

[Peter Schober]

* nduan at dtechspace.com <nduan at dtechspace.com> [2014-02-17 19:10]:
> Once the user is authenticated using X.509 cert in 2-way SSL setting, 
> I'd like to get the user attribute returned from LDAP.  The LDAP 
> resolver requires the parameter $requestContext.principalName to 
> retrieve user attributes.  Is there any simple way to set the 
> principalName to be the user DN retrieved from the cert automatically?  
> Or do I have to create a customized login module to set principalName 
> programmatically?

For what deployment model? If you're doing everything in Apache httpd
all the Shib IDP sees is REMOTE_USER being set to a string. So that's
a question of how you configure httpd (non Shibboleth).

If you're asking about the X.509 login handler for the Shib IDP, its
documentation is here. Basically you pick out what you want via a
script in the IDP's resolver:
https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler
-peter