Substituting another attribute for mail

[Andrew Morgan]

On Tue, 30 Aug 2016, Edenfield, Dusty wrote:

> We are trying to implement Dropbox SSO and have hit a snag.  Dropbox is 
> registered with InCommon and accepts the essential attribute bundle as 
> explained in their documentation<https://www.dropbox.com/help/9125>. 
> Dropbox states that it uses the email part of the bundle to identify 
> users.  For us, the email attribute is an email alias that may change 
> depending on user preference or if they sign in under a different 
> account that they own.  We would prefer that Dropbox uses EPPN as the 
> identifier since it is consistent across accounts for a given user.
>
> Is there a way to substitute EPPN for the mail attribute that Dropbox 
> sees?  The result would be that EPPN and mail match, and Dropbox doesn't 
> know about the email alias issue.

Sure, you can create a new attribute in attribute-resolver.xml:

     <resolver:AttributeDefinition xsi:type="ad:Simple" id="dropbox_email" sourceAttributeID="eduPersonPrincipalName">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
     </resolver:AttributeDefinition>

Then release it only to Dropbox and deny the release of your "normal" 
email attribute in attribute-filter.xml:

     <AttributeFilterPolicy id="dropbox">
         <PolicyRequirementRule xsi:type="Requester" value="<dropbox-entityid>" />
         <AttributeRule attributeID="dropbox_email">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="email">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>


 	Andy