Split displayName to givenName and cn

[Kannadasan Venkatachalam]

Peter thanks for the inputs. Our Organizational AD has the students names starting and ending with "#" (for some reasons that I am unaware of). That is why I need to remove it at SP end. Yes there was typo in my email it should be "sn" and not "cn"

I managed to resolve the issue with what Scott had replied. Following is the entry in the shibboleth2.xml file that helped to resolve the issue. As shared by David and Scott I agree that it is not logical to split the name as I am not sure what is their surname. Moreover there are also international students in our organization.

<AttributeResolver type="Transform" source="displayName">
         <Regex match="^#(.+)#$" dest="givenName">$1</Regex>
         <Regex match="^#(.+)#$" dest="sn">-</Regex>
 </AttributeResolver>

This works for now, if you guys see any other issues with this approach please do share.

Thank you all for your kind help.

-venki

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, April 26, 2017 4:39 PM
To: users at shibboleth.net
Subject: Re: Split displayName to givenName and cn

* Kannadasan Venkatachalam <venki at ntu.edu.sg> [2017-04-25 16:42]:
> Thank you all for the inputs. Sorry I forgot to mention that the
> displayname is in our case #Joan Paul Jones# and we would like to
> strip off # and populate  cn=Joan Paul Jones and givenName=.

If the IDP literally sends "#Joan Paul Jones#" (wthout the quotes but including the hash signs) as displayName attribute value the IDP is misconfigured. Why would one send an attribute value with additional '#' characters both at the beginning and at the end of the value -- only to force the SP to remove them? So I'd start with getting the IDP fixed.

You don't mention what the expected semantics are for the "cn"
attribute your application wants, but the RFC-definition (4519) of "cn" says its "typically the person's full name", which is basically identical to displayName (only that displayName is single-valued).
So you could simply map the incoming SAML attribute displayName to "cn" in your SP, using the attribute-map.xml.
Unless you meant to say your application wants "givenName and sn", not "givenName and cn"?

That only leaves splitting off some part of the displayName string to use as givenName, which the existing SP documentation covers, as mentioned by Scott:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeResolver#NativeSPAttributeResolver-TransformAttributeResolver(Version2.5andAbove)

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________
CONFIDENTIALITY: This email is intended solely for the person(s) named and may be confidential and/or privileged. If you are not the intended recipient, please delete it, notify us and do not copy, use, or disclose its contents.
Towards a sustainable earth: Print only when necessary. Thank you.