Need help with canonicalization and attribute resolver in a mutual auth scenario.

[Cantor, Scott]

On 7/14/15, 5:40 PM, "users on behalf of Johan Åkerstrøm" <users-bounces at shibboleth.net on behalf of Johan.Akerstrom at skill.no> wrote:
>
>OK, Should I think bearer of the token and just look at asserted attributes?

I'm not sure what you're asking. All SSO via browser in SAML is bearer-asserted. If you're asking me if the attributes should be used in favor of the NameID, yes. The NameID element is inflexible and essentially is like a single-valued attribute with less standardization. The only use cases well-defined in SAML for that element are basically transient, persistent, and email address.

>Added debug level logging now and can see that the CN is pulled from the certificate in idp-process .log not sure how that is linked in to an attribute.

It isn't unless you do so, which is covered in the documentation.

>I don't know how to pull the principal from the session into an attribute.

I told you how, with the Principal AttributeDefinition plugin.

>>How do I use the whole subject (which corresponds to an LDAP distinguished name) from the certificate to lookup other attributes or group memberships in our LDAP directory?

I realized after I sent that that it's really quite simple: you don't. The usual method is to use something unique from the DN as the principal name and then just perform an LDAP search for that entry based on that value.

-- Scott