EncryptedID in attribute

[Cantor, Scott]

> I can add the SectorID to my attribute-map but the only
> AttributeDecoder that seems to do anything is the XML AttributeDecoder
> and it only gives me the child XML elements in base64.  I know
> Shibboleth can decode EncryptedID's when they're in
> ArtifactResponse/Response/Assertion/Subject, this is done in
> SAML2Consumer::implementProtocol(). But I can't find an
> AttributeDecoder that can do do the same. Is this possible in
> Shibboleth 2.5.3?

No, nothing like that is provided. I don't think building a decoder to do that will be that much work, and you have about a day to get a Jira issue in if you want it. But that said, tell them to stop. This is not appropriate. Putting a NameID into an Attribute at all is a lousy idea, but if you want to encrypt it, you don't do it like this. If you need a self-standing encrypted attribute, you use EncryptedAttribute.

-- Scott