attribute release base on a cross-listed attribute in metadata

[Cantor, Scott]

On 2/25/15, 6:42 PM, "Tom Scavo" <trscavo at gmail.com> wrote:



>How do I configure the following attribute release policy in Shib IdP V2:
>
>If ePPN is listed as an <md:RequestedAttribute> element in SP
>metadata, release ePTID.

With the very latest patch, you put an attributeName into the 
<PermitValueRule> that references the attribute you're looking for in the 
metadata.

e.g.
<AttributeRule attributeID="eduPersonTargetedID">
	<PermitValueRule xsi:type="saml:AttributeInMetadata" 
attributeName="urn:oid:..."/>
</AttributeRule>


>If the answer is "this can't be done in V2," can it be done in V3?

Well, in V3 we don't really want to ever say the word eduPersonTargetedID 
ever again, but mechanically what you would ideally do is apply that same 
release policy to the source attribute for the persistentID generator that 
produces the NameID, and that would more or less have a similar effect.

But if you produce it all with the resolver old-style, it works the same.

-- Scott