Subject Canonicalization problem

[Michael A Grady]

> On Nov 8, 2015, at 3:52 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
> On 11/8/15, 4:29 PM, "users on behalf of Doan, Tommy" <users-bounces at shibboleth.net on behalf of tdoan at smu.edu> wrote:
> 
> 
> 
>>> Thanks Scott. If we created a scripted attribute that obtained the username from the Java Subject, would it need to have dependencies?
> 
> Not unless it needed them for some reason.
> 
>>> Would it then be possible to define an LDAP data connector that depended on that attribute, so we could obtain the attribute we need?
> 
> You can define anything on top of it you wanted, I'm just saying that the starting point here isn't the normal/simple case people are used to, which was mentioned very lightly in the docs but I expanded it to try and explain that better.
> 
>> The objective is to allow our users to login to the IdP with either of two LDAP attributes as their username, but then normalize to a consistent username to send to Duo - I misspoke in the original post when I said the effort was for interaction with Box.
> 
> I see.
> 
> It's basically a one-liner script to pull out the value into an attribute you can use as a dependency, so not that big of a deal, just not obvious without explanation.
> 

Would that be something like (building on what you sent before, and delving into the Java code around this:

userProvidedUsername = profileRequestContext.getSubcontext(
	"net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getSubject().getPrincipals(UsernamePrincipal.class).iterator().next().getname();
Scripted.addValue( userProvidedUsername );

--
Michael A. Grady
IAM Architect, Unicon, Inc.