mapping attributes at the SP

[Peter Schober]

* Mark K. Miller <max at psu.edu> [2015-09-23 00:04]:
> If an SP is aready receiving a scoped attribute (like
> eduPersonPrincipalName) from an IdP, is there a way for the SP to
> use that to create a new attribute that does not include the scoping
> information? If so, could someone provide an example, or a pointer
> to an example?

Just a reminder that eppn is only globaly unique when it's intact,
including the scope. foo at example.edu and foo at different.example.com
would both map to 'foo'. Just something to be aware, if the SP in
question could be accessed by more than your own local IDP.

In cases where I (also) needed unscoped identifiers from the local IDP
(in addition to accepting scoped identifers from federated IDPs) I
requested 'uid' from the local IDP and set up the SP's
attribute-policy.xml to accept 'uid' /only/ from the local IDP,
discarding it from all others.
Then apply some abstraction to make both attributes (eppn, uid)
available to the application as one, if needed, such as REMOTE_USER or
using one of the new resolver plugins.
-peter