ArcGIS on Shib 3

[Cantor, Scott]

On 6/25/15, 9:56 AM, "users on behalf of Rich Graves" <users-bounces at shibboleth.net on behalf of rgraves at carleton.edu> wrote:



>Their SSO configuration form has a field for attribute mapping. However, they eventually acknowledged that it probably does not actually do anything. Accept that you need to give them username as NameID. You're probably defaulting to transientId. Here's one way (not necessarily the best way) to allow username and explicitly deny transientId to specific SPs. Then you allow your username attribute, which we (mis)labeled "principal."

That's all old advice, even for V2.

To support a custom NameID format:

1. Define and release an attribute to that SP containing the data to supply.
2. Pick a format.
3. Add that format constant to the SP's metadata in a <NameIDFormat> element.
4. Configure saml-nameid.xml to support the format by uncommenting the attribute-sourced NameID generator plugin and telling it the format to use and the attribute ID to pull from.

Easy squeezy.

In the rare cases you can't manipulate the metadata, you can specify the format for the SP in a property in a custom RelyingParty definition for the SP.

You should *never* need to "deny" release of anything to get this to work, and in V3 there is no "transient" attribute ID to control the release of anyway.

-- Scott