shibboleth.c14n.attribute.PrincipalNameLookupStrategy bean

[Cantor, Scott]

On 2/15/17, 7:51 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:

> The existing example *does* work.  I've been using it since last year.
>  Uhh, I don't understand how it works though.

I don't either, but it's moot, there's no reason to do it that way now.

> I don't understand your code example either, though.  How does it know the
> correct output value (username)?  Where is it getting it from?

The output value of the script or of the whole process?

The script is just saying "use the name the user entered in some earlier login factor that's sitting in the tree". Normally you do this after password factor is completed, so that's the value from the login form.

The bean's purpose is to apply that script to produce the value to stick inside $resolutionContext.principal when the resolver runs in this special use case.

My resolver example applies that value to a simple LDAP search to compute the final value to use as the subject's name (uid in the example).

If this all runs in between Password and Duo, then what Duo gets as input by default is that uid value, so email has been mapped into uid before Duo runs.

That's the use case being illustrated (and really, it's about the only real one I can think of for this feature).

-- Scott