question about configuration in IdPv2 config

[Brent Putman]

On 7/13/16 3:47 PM, Michael Weyandt wrote:
> In my attribute-resolver.xml I have the following..
>
>  <resolver:AttributeDefinition id="principal"
> xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
>       <resolver:Dependency ref=“ldap-auth" />
>       <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>          
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
>     </resolver:AttributeDefinition>
>
> Basically just trying to understand what they were doing with this.
>
> To me it looks like a Principal Name Attribute mixed with a custom
> name identifier?
>

Yes, that's basically it.  It's going to encode the user's principal
name as a SAML 2 NameID, with the NameID having that unspecified format
URI. 

The principal name is an internal value managed within the IdP, which
is usually the identifier they used when they authenticated.   It's
usually going to be the username the user used when logging in,
although it can technically be more complicated than that if you are
doing something more esoteric with authN. [1].

Btw, that ldap-auth dependency is not used and could be removed, since
the PrincipalName attribute def doesn't evaluate it.

[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverPrincipalNameDefinition
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160713/c85345e6/attachment.html>