mapping attributes at the SP

[Mark K. Miller]

On Wed, 23 Sep 2015, Peter Schober wrote:

> * Mark K. Miller <max at psu.edu> [2015-09-23 00:04]:
>> If an SP is aready receiving a scoped attribute (like
>> eduPersonPrincipalName) from an IdP, is there a way for the SP to
>> use that to create a new attribute that does not include the scoping
>> information? If so, could someone provide an example, or a pointer
>> to an example?
>
> Just a reminder that eppn is only globaly unique when it's intact,
> including the scope. foo at example.edu and foo at different.example.com
> would both map to 'foo'.

Of course!  ;-)

>                           Just something to be aware, if the SP in
> question could be accessed by more than your own local IDP.

And, if I had a nickel for everytime I've had this discussion with a 
vendor, I could probably be retired by now.  Sadly, so many vendors see 
SAML as merely an SSO solution, and don't fully understand the 
implications of true federating.  Probably because very few really 
implement true federating.

> In cases where I (also) needed unscoped identifiers from the local IDP
> (in addition to accepting scoped identifers from federated IDPs) I
> requested 'uid' from the local IDP and set up the SP's
> attribute-policy.xml to accept 'uid' /only/ from the local IDP,
> discarding it from all others.
> Then apply some abstraction to make both attributes (eppn, uid)
> available to the application as one, if needed, such as REMOTE_USER or
> using one of the new resolver plugins.

I don't expect to be getting into all of this.

In any case, it's been a while since I've thanked you for the 
contributions you're always making on this list.  Even if I can't always 
make direct use of your advice, rest assured your effort is still very 
much appreciated!

> -peter

Thank you!

Max