SP 2.5.2 / PHP / metadataAttributePrefix

[Phil Lello]

> >I'd expect those attributes to come through as Meta-eppn, Meta-mail, and
> Meta-uid.
>
> Not unless you're excepting those attributes to be inside the IdP's
> metadata as EntityAttribute extensions, which doesn't really make a lot of
> sense, so I don't think you are.
>
> You're confusing this with attributePrefix (I think that's what I called
> it). That's a different setting.
>

My confusion comes from
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication:


>    - metadataAttributePrefix(string)
>       - If set, attributes extracted from metadata have their IDs and
>       aliases prefixed with this value. Allows applications to distinguish
>       between attributes about the user and attributes about the user's identity
>       provider.
>
> And
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-MetadataAttributeExtraction%28Version2.2andAbove%29
:

To ensure they can be distinguished from more typical user data, the
> trigger for this feature is the metadataAttributePrefix application
> <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication>
> property. Setting this property is both a precondition for metadata
> attribute extraction and a value that is prepended to the internal
> attribute names that result. For example, a prefix of "Meta-" will turn an
> extracted attribute called "mail" into "Meta-mail".
>

I'm probably completely failing to recognise the importance of "internal"
in "internal attribute names", but those links seem to suggest that an
application (which I thought of in this context as libapache2-mod-php5)
should be able to pick up principal attributes by looking for "Meta-".

However, it looks like I can use attributePrefix instead, look for that
prefix in environment variables, exclude things starting with 'Shib-', and
be left with a map of released attributes. It just feels a little
convoluted, which makes me think I'm missing something (more than likely
given it's approaching 1:00AM)

Phil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150417/c2afe909/attachment.html