building an AD userPrincipleName attribute

[Cantor, Scott]

On 9/10/15, 3:32 PM, "users on behalf of Rob Gorrell" <users-bounces at shibboleth.net on behalf of rwgorrel at uncg.edu> wrote:

>We are in the middle of deploying IU's Kumo application. Without getting into what Kumo is, their SP needs to consume an attribute that matches our Active Directory userPrincipleName. However, because AD is not our identity store for shibb, and AD doesn't own the uncg.edu <http://uncg.edu> namespace, eppn != userPrincipleName. I'm also not too interested in storing AD UPN's in our LDAP. So what I would like to do is be able to create a custom attribute by taking our username (cn) and simply append
> a static string "@campus.uncg.edu <http://campus.uncg.edu>" matching our AD domain to form an representation of our AD UPN and release this to Kumo.

That's fine, assuming that's the same value obviously.

>I'm not very versed with attribute transformations, but I imagine this one isn't too difficult, however I could use some guidance from the more SAML savy in what an attribute definition for something like this might look like.

Because this isn't a formally "scoped" attribute in the sense that we mean it, the best choice is probably just to use the Template attribute definition with a template like ${requestContext.principalName}@scope

> IU recommends we name this custom
> attribute "https://schemas.uits.iu.edu/CloudStorage/Identity/UPN"

If it's literally the MS UPN, the other poster's suggestion to use Microsoft's claim name for that concept isn't a bad one.

-- Scott