Subject Canonicalization problem

[Cantor, Scott]

On 11/8/15, 4:29 PM, "users on behalf of Doan, Tommy" <users-bounces at shibboleth.net on behalf of tdoan at smu.edu> wrote:



>>Thanks Scott. If we created a scripted attribute that obtained the username from the Java Subject, would it need to have dependencies?

Not unless it needed them for some reason.

>> Would it then be possible to define an LDAP data connector that depended on that attribute, so we could obtain the attribute we need?

You can define anything on top of it you wanted, I'm just saying that the starting point here isn't the normal/simple case people are used to, which was mentioned very lightly in the docs but I expanded it to try and explain that better.

>The objective is to allow our users to login to the IdP with either of two LDAP attributes as their username, but then normalize to a consistent username to send to Duo - I misspoke in the original post when I said the effort was for interaction with Box.

I see.

It's basically a one-liner script to pull out the value into an attribute you can use as a dependency, so not that big of a deal, just not obvious without explanation.

-- Scott