Cisco Spark SSO with Shibboleth IdP.

[Maokhampio, Michel]

Hi all,

We are planning on integrating Cisco Spark (a SAML based SP) with our Shibboleth IdP. According to the documentation provided to us, Cisco Spark expects mail attribute from IdP and uses it as user identifier. However, they want the mail attribute released in name mail-attr, which means, per Cisco Spark documentation, the following configuration needs to be added in resolver:

    <resolver:AttributeDefinition id="mail-attr" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="MyLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid" />
     </resolver:AttributeDefinition>

We are able to accommodate this but typically we do not prefer to add SP-defined custom attributes into our configurations. So we are wondering if there has been other practice to work around this.

Another concern we have is use of mail attribute as identifier. Since email addresses are relatively often subject to changes, it might not be a good candidate of key identifier.

Thank you,
Michel
UCLA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170720/1d973007/attachment-0001.html>