Split displayName to givenName and cn

[Peter Schober]

* Kannadasan Venkatachalam <venki at ntu.edu.sg> [2017-04-25 16:42]:
> Thank you all for the inputs. Sorry I forgot to mention that the
> displayname is in our case #Joan Paul Jones# and we would like to
> strip off # and populate  cn=Joan Paul Jones and givenName=.

If the IDP literally sends "#Joan Paul Jones#" (wthout the quotes but
including the hash signs) as displayName attribute value the IDP is
misconfigured. Why would one send an attribute value with additional
'#' characters both at the beginning and at the end of the value --
only to force the SP to remove them? So I'd start with getting the IDP
fixed.

You don't mention what the expected semantics are for the "cn"
attribute your application wants, but the RFC-definition (4519) of
"cn" says its "typically the person's full name", which is basically
identical to displayName (only that displayName is single-valued).
So you could simply map the incoming SAML attribute displayName to
"cn" in your SP, using the attribute-map.xml.
Unless you meant to say your application wants "givenName and sn", not
"givenName and cn"?

That only leaves splitting off some part of the displayName string to
use as givenName, which the existing SP documentation covers, as
mentioned by Scott:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeResolver#NativeSPAttributeResolver-TransformAttributeResolver(Version2.5andAbove)

-peter