Subject Canonicalization problem

[Doan, Tommy]

>But if you did want to actually normalize it, you can't just use a simple configuration like that right now. The input data to the c14n step is not a simple name (because if it were you'd be done), it's a Java Subject. You pretty much always end up needing to use a script connector or attribute definition for this particular feature, that's the only built-in way that the Subject could be accessed. It's in a child context:

>profileRequestContext.getSubcontext(
>	"net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getSubject()

>Inside there you have Principals, and one of them is the value the user supplied (in a UsernamePrincipal).

Thanks Scott. If we created a scripted attribute that obtained the username from the Java Subject, would it need to have dependencies? Would it then be possible to define an LDAP data connector that depended on that attribute, so we could obtain the attribute we need? 

The objective is to allow our users to login to the IdP with either of two LDAP attributes as their username, but then normalize to a consistent username to send to Duo - I misspoke in the original post when I said the effort was for interaction with Box.