shibboleth.c14n.attribute.PrincipalNameLookupStrategy bean

[Andrew Morgan]

On Thu, 16 Feb 2017, Cantor, Scott wrote:

> On 2/15/17, 8:52 PM, "users on behalf of Andrew Morgan" 
> <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>> This is no different than before, but the logging is kinda funny:
>
> I guess I'd call it "accurate", what would an alternative do and how 
> would it work? The Duo flow doesn't operate on the value being logged by 
> the LDAP bean. The value's around, but it's buried inside some earlier 
> flow's result, nothing the Duo flow knows about.
>
> I guess one point to make is that you can make the Password flow do 
> simple pre-login transforms like chopping email domains. If that's the 
> only transform needed, you probably don't need all this extra machinery 
> at all. This is for mapping between data you can only crosswalk with 
> directories.

If I modify the Password flow to strip the domain and lowercase the 
username, do I need to perform post-authn canonicalization?  Will the 
transformed username be used for everything downstream?

I was reading more about post-authn canonicalization last night, and I 
realized that the "simple" transform is all I needed there.  I didn't 
realize the Password flow had similar features.

Sorry for all the extra work, but at least we got a simpler example on the 
documentation page for attribute-sourced c14n!

Thanks for taking the time to explain it all.

 	Andy