PersistentSAML2NameIDGenerator requires releasing attributeSourceIds

[Walter Forbes Hoehn (wassa)]

Something like this should work:

<resolver:AttributeDefinition id=“uid" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="uid">
   <resolver:Dependency ref=“directory” />   
   <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:uid" />
   <resolver:AttributeEncoder xsi:type=“SAML2String” xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" / >
</resolver:AttributeDefinition>

<resolver:AttributeDefinition id="persistentNameIdSourceUid" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="uid">
  <resolver:Dependency ref=“directory" />
</resolver:AttributeDefinition>

-Walter


> On Apr 10, 2015, at 9:34 AM, Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> * Marvin Addison <marvin.addison at gmail.com> [2015-04-10 16:07]:
>> I have to admit I don't understand your justification in detail, but I
>> trust you. In any case I can meet my needs by not attaching an encoder to
>> the source attribute to prevent disclosure.
> 
> So if I wanted to release the source attribute to some, but to others
> only the NameID generated from it? That's a very common scenario I
> would guess (e.g. source attribute being uid, for those lacking a
> persistent not-name-based identifier in their SORs)?
> -peter
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net