IdPv3 and subject canonicalization

[Cantor, Scott]

On 11/4/15, 7:07 PM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:



>For post login subject canonicalization, if I want to use the attribute-based one, I know I need to:
>
> - enable (uncomment) in conf/c14n/subject-c14n.xml
> - configure in conf/c14n//attribute-sourced-subject-c14n-config.xml
>
>But do I need to comment out (disable) the c14n/simple flow at the same time?

No, it runs last. It will only run if the earlier ones don't work. It's more or less like authentication, it tries them in order.

>And, in looking at the system flows, I see that this subject canonicalization is configured to occur after a configured "initial authentication".  That means that if I've used "initial authentication" to get username/password to occur before calling Duo, that the attribute subject canonicalization will have already occurred before invoking Duo, correct?

Yes, but right now this is a self-contained attribute lookup. It doesn't put the results anywhere that is really meant to be usable by anything else. It's meant to be a black box, basically, just one that you can configure in the same place as all the other attributes.

-- Scott