Other ways to transform binary LDAP balues?

[Cantor, Scott]

> Without the LDAPProperty element, the IdP passes the binary data back
> through to the relying party verbatim.  The ePPN it constructed looked
> like something out of the Nezperdian hive-mind of chaos. :)

In that case you would just need to directly operate on that via script and could skip the decoding step. Just don't pass it through and it should be fine.

> By scripting, do you and Scott mean "Scripted Attribute Definition"
> (https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition)?

Yes.

> If possible would you point me at any examples?  I found "Developing
> Attribute Resolver Extensions"

He's talking about wiring up objects out of Ldaptive with Spring, I think. That would be just writing new Java code to plug into the resolver, but that's more work than writing a 1-2 line script.

-- Scott