NameIds (again)

[Dave Perry]

There was no use of the word 'internal' in the definition. Here is the corrected version, if it helps:

    <resolver:AttributeDefinition xsi:type="ad:Scoped" id="g_principal" scope="gtest.hull-college.ac.uk" sourceAttributeID="sAMAccountName">
        <resolver:Dependency ref="myLDAP" />
        	<resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                   name="urn:oid:1.3.6.1.4.1.9902.2.1.9" friendlyName="g_principal" />
    </resolver:AttributeDefinition>

I initially had no AttributeEncoder part there, and xsi:type was "SAML2StringNameID" - that was causing it to fail to generate the nameID.

(normally I would just the mail attribute as the sourceAttribute, but as this is for a test system tied to an AD server I have no control of, I'm having to use a scoped attribute definition)

Dave
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 29 September 2016 14:13
To: Shib Users
Subject: Re: NameIds (again)

On 9/29/16, 8:25 AM, "users on behalf of Dave Perry" <users-bounces at shibboleth.net on behalf of Dave.Perry at hull-college.ac.uk> wrote:

> I fixed it by adding an encoder (I thought someone had said you didn't 
> need to, if an attribute was purely for NameID generation)

That is correct.
 
> and setting the encoder type as Scoped string vs NameID.

I don't know what that refers to. Using a deprecated StringNameID encoder would work but is just the alternative means of generating a NameID. Still works certainly, I use that myself due to my config being older/upgraded.

But adding just any old encoder to an AttributeDefinition would not have any impact on whether the resolver surfaces the attribute or not. At least I'm not aware that it does, that would be a bug.

Was the definition marked "internal"? If not, if removing the encoder causes the attribute to disappear internally, there's a bug.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT