change user in CAS serviceResponse element

[Cantor, Scott]

On 7/13/15, 9:14 AM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

> Thus subject canonicalization does not run at ticket validation time where you could run a different canonicalization flow to get a different sort of principal for the CAS protocol.

It would likely be simpler to just embed the feature to populate that element of the CAS response from an attribute if desired.

> Ideally the subject canonicalization flow would run at ticket validation time,
> but it wasn't clear to me how to do that initially. I'm open to suggestions for improvement.

It's not a UI flow so it could be run I suppose.

Because I used the c14n machinery in a couple of different ways, I ended up creating separate lists of those flows for the different functional areas (one post-login, one for mapping SAML NameIDs into users), so it's certainly possible to add more. But I would guess 99% of cases would be met with the ability to just look at an attribute anyway.

-- Scott