ADFS to Shibboleth

[Mercer, Keith]

The SP is controlled by another company we are connecting too.  If I manually add a number to our active directory attribute of employeeNumber the connection will work using the OID below so it's the correct one for employeeNumber so I am just trying to have it query AD to grab the employeeID and send it to the SP as employeeNumber's oid.

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Etan Weintraub
Sent: Thursday, January 2, 2014 3:57 PM
To: Shib Users
Subject: RE: ADFS to Shibboleth

Do you control the SP to be able to tell it where to look for the employeeNumber? If not, then you'll need to change the OID that your ADFS IdP is sending the employeeID across in to make it match what the SP is expecting for employeeNumber.

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of Mercer, Keith
Sent: Thursday, January 02, 2014 4:55 PM
To: Shib Users
Subject: RE: ADFS to Shibboleth

Our side of the house if ADFS IdP so we have no Shibboleth at our site.

From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of Etan Weintraub
Sent: Thursday, January 2, 2014 3:52 PM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: RE: ADFS to Shibboleth

Keith-
Have you tried using Active Directory as your Data Source within your Shibboleth IdP? Or is this just a Shibboleth SP that you are going to from an ADFS IdP?

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of Mercer, Keith
Sent: Thursday, January 02, 2014 4:45 PM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: ADFS to Shibboleth

I am trying to see if there is a way to make a rule that would get the LDAP attribute of employeeid from our active directory and then send it as employeeNumber over to Shibboleth?  The below are the custom rules needed for employeenumber that I was thinking that I could possible edit to make work.  I am not even sure if something like this is possible.

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => add(store = "Active Directory", types = ("urn:oid:2.16.840.1.113730.3.1.3"), query = ";employeeNumber;{0}", param = c.Value);

c:[Type == "urn:oid:2.16.840.1.113730.3.1.3"] => issue(Type = c.Type, Value = c.Value, Issuer = c.Issuer, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");

I thought could change query= to employeeID but that didn't see to work.  I am thinking I would need to do something with the iod's also.  Any assistance would be helpful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140102/086e94db/attachment-0001.html