ArcGIS on Shib 3

[McKean, Brandon Scott - mckeanbs]

Good points Peter. I just got name formatting worked out for our
configuration. They wouldn't take the straight displaynameprintable
being passed to it, as it then mixed up my first and last name and left
a comma in.
My solution was to make a custom givenName attribute definition just
for their givenName, as follows, and set up attribute-filter to use it:
<resolver:AttributeDefinition id="givenNameArcGIS"
xsi:type="ad:Template">
        <resolver:Dependency ref="givenName" />
 
       <resolver:Dependency ref="sn" />
       
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:givenName" />
       
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.42" friendlyName="givenName" />
       
<ad:Template>
          <![CDATA[
               ${givenName} ${sn}
      
    ]]>
        </ad:Template>
       
<ad:SourceAttribute>givenName</ad:SourceAttribute>
       
<ad:SourceAttribute>sn</ad:SourceAttribute>
   
</resolver:AttributeDefinition>
Hope this is helpful Tony.
Regards,

-- 
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235
On Fri, 2015-06-26 at 11:54 +0200, Peter Schober wrote:
> * Tony Skalski <ajs at stolaf.edu> [2015-06-25 22:30]:
> > Are you seeing surname and email address flow into Arcgis.com? We
> > have been able to get the auth to work but unable to get surname
> > and
> > email address working.
> 
> Note that according to their docs the attribute names will have to be
> changed (from urn:oid:... to basic names), with an accompaning change
> to the NameFormat, too (to be correct; not that I think they care).
> Also they only claim to support your "full name" in an attribute
> named
> "givenname", so no seperate fields for givenname and surname (i.e.,
> they're using givenname when they should be using displayName).
> And email addresses can be released as (again: basic) attribute
> names,
> but also need to identify the subject in the NameID.
> 
> So plenty of reasons that would not work out of the box with a Shib
> configuration, not even one that interoperates successfully with many
> other SPs.
> 
> "Unable to get ... working" is not a technical error description, of
> course, so you'd need to look at the details mentioned above and
> previously in this thread.
> -peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150626/a7939142/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150626/a7939142/attachment-0001.bin>