SAML2StringEncoder Name for RelationalDatbase Attribute

[Andrew Morgan]

On Tue, 15 Mar 2016, David E. Newswanger wrote:

> Hi All,
>
>
> I'm trying to configure shibboleth to pull attributes from a MySQL 
> database. How do I figure out what the name is for the attribute encoder 
> for a MySQL column name? LDAP attributes have an OID which is usually 
> something along the lines of 2.5.4.4, which would translate to the 
> following AttributeEncoder:
>
>
> <resolver:AttributeEncoder xsi:type="enc:SAML2String" 
> name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" />
>
>
> As far as I can tell (and I may be wrong), MySQL doesn't haven an OID 
> for each attribute. What should I put in the name section for the 
> AttributeEncoder element of some attribute that I get out of a MySQL 
> table?

The "name" above is how the attribute is identified on the wire when it is 
sent to an SP.  In your example above, 2.5.4.4 is the OID for the LDAP 
attribute "sn" (surname).  If you are exchanging well-known attributes 
such as sn, cn, givenName, mail, eduPersonPrincipalName, etc, use their 
OID number, which you should already find in your attribute-resolver.xml 
file.

Remember, these don't have anything to do with the MySQL column.  They 
just describe the attribute in the SAML assertion that is sent to the SP. 
The sourceAttributeID tells the resolver where to get the value (such as 
an LDAP attribute or MySQL column).  The AttributeEncoder tells it how to 
encode the value in the SAML assertion.

Your column could be named "mylocalsurname" (and you would use that as the 
sourceAttributeID), but when you encode it for an SP, use the well-known 
name "urn:oid:2.5.4.4".

If you are dealing with custom attributes, use whatever the SP wants or 
define something in your own OID namespace (if you have one).

 	Andy