V3 PrincipalConnector replacement (was: V2 to v3 Config change help)

[James Drews]

> You told it to use the computed persistent ID generation strategy (that's one of the properties). Just follow every step in the > documentation if you want to use a database, it will tell you to change that property.

OK, that was a close enough hint. Looking at configs to long. The default installed file had a commented line for the idp.transientId.generator, removed the comment and saw the:
# Set to shibboleth.StoredTransientIdGenerator for server-side storage
Line above and my eyes didn't notices the default in the line below that was NOT the Stored generator.  It's working now.


Next bit in the conversion.  We used to have a PrincipalConnector in v2 to take the AttributeQuery with a supplied attribute to re-map to the principal name.  Wrote some code based on an example provided years ago to make it happen. But, v3 didn't move that config forward (and apparently nobody cared to mention the problem to me until now, and they want the feature back). When trying to re-enable it with v3.3, it just doesn't like it. That's fine, I can take this as an opportunity to move forward and away from the Legacy stuff.  But I'm not seeing any examples that apply or what is needed to write a new plugin.

Here is the use case:

Large university where central campus runs one IDP (#1).  Engineering college also runs a IDP (#2). The AuthN between them is different, but on the attribute side, both have a shared common identifier for each person. The goal was, when an SP used IDP #1 to AuthN, the SP would use the back channel to IDP #2 to enhance/augment the attributes from IDP #2 (ie, IDP #2 is also acting as an attribute authority).

In this case, the shared identifier is essentially a second key field in the DB storing the attributes. The plugin written for v2 did the lookup of the shared identifier and returned the primary key used by the IDP #2 for its attribute query.

I've stared at https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration  for quite some time and still don't see a way to make this happen.

I've added the name format to the shibboleth.NameTransformFormats in subject-c1n.xml, but haven't found any appropriate examples of shibboleth.NameTransforms. A simple reg-ex (as is the example provided) won't work.

Pointers greatly appreciated.

James




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170127/ce82ae74/attachment-0001.html>