EncryptedID in attribute

[Brent Putman]

On 6/22/16 8:39 AM, Cantor, Scott wrote:
>> I can add the SectorID to my attribute-map but the only
>> AttributeDecoder that seems to do anything is the XML AttributeDecoder
>> and it only gives me the child XML elements in base64.  I know
>> Shibboleth can decode EncryptedID's when they're in
>> ArtifactResponse/Response/Assertion/Subject, this is done in
>> SAML2Consumer::implementProtocol(). But I can't find an
>> AttributeDecoder that can do do the same. Is this possible in
>> Shibboleth 2.5.3?
> No, nothing like that is provided. I don't think building a decoder to do that will be that much work, and you have about a day to get a Jira issue in if you want it. But that said, tell them to stop. This is not appropriate. Putting a NameID into an Attribute at all is a lousy idea, but if you want to encrypt it, you don't do it like this. If you need a self-standing encrypted attribute, you use EncryptedAttribute.

Just noting that he also said this was buried in the Response
Assertion's Advice element:

ArtifactResponse/Response/Assertion/Advice/Assertion/AttributeStatement/Attribute/AttributeValue/EncryptedID


Does the SP even support something like that?  Would that still just be
a different decoder impl, or is that completely different logic to look
in the Advice?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160622/2cbb07c4/attachment-0001.html>