attribute release base on a cross-listed attribute in metadata

[Tom Scavo]

On Wed, Feb 25, 2015 at 1:52 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 2/25/15, 6:42 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>>How do I configure the following attribute release policy in Shib IdP V2:
>>
>>If ePPN is listed as an <md:RequestedAttribute> element in SP
>>metadata, release ePTID.
>
> With the very latest patch

Do you mean IdP 2.4.3 only?

> you put an attributeName into the
> <PermitValueRule> that references the attribute you're looking for in the
> metadata.
>
> e.g.
> <AttributeRule attributeID="eduPersonTargetedID">
>         <PermitValueRule xsi:type="saml:AttributeInMetadata"
> attributeName="urn:oid:..."/>
> </AttributeRule>

Cool, thanks.

>>If the answer is "this can't be done in V2," can it be done in V3?
>
> Well, in V3 we don't really want to ever say the word eduPersonTargetedID
> ever again

Are you recommending against ePTID in favor of the SAML2 Persistent NameID?

> but mechanically what you would ideally do is apply that same
> release policy to the source attribute for the persistentID generator that
> produces the NameID, and that would more or less have a similar effect.

I think that pretty much answers my previous question.

> But if you produce it all with the resolver old-style, it works the same.

Great, thanks!

Tom