Help setting REMOTE_USER to attribute NameIdentifier - Linux / Apache / SP 2.6

[Cantor, Scott]

On 6/9/17, 11:45 AM, "users on behalf of Adam von Nieda" <users-bounces at shibboleth.net on behalf of adam at vonnieda.org> wrote:

>   Can you or someone help me map it correctly please?

I am, for free, by explaining how it works.
 
> I don’t fully understand how all of this works

Then ask me about something specific you don't understand that I've said, as below, or that the documentation which I assume you have read contains, and I'll answer it in detail.

> The configuration I sent in my previous email was what I thought would work, but it doesn’t.

What you posted at the very beginning of all this has no connection to what you posted, so I'm making guesses and including caveats because nothing you have posted has any consistency. You told me the IdP sent you a NameID with a format containing a simple string value, and now you're asking me if mapping an OID URN will work. It won't, unless what you're doing has changed on me.

I have no idea if you've changed what you're trying to map or not, so I'm guessing, and essentially avoiding specifics by explaining how it works, not what your specific case is or isn't.

Lastly, I told you that using that ScopedAttributeDecoder in the mapping is not what you want, and that the shibd log will probably note that by failing in some way with a warning or error.

"Scope" in this software has very specific meaning that rarely applies well outside of the higher education federations that use it and doing basic federation B2B with things like ADFS are not going to accomodate that. Mapping basic information, Attribute or NameID/NameIdentifier, is handled with the StringAttributeDecoder, which is the default one used when you just omit it, which is how many of the examples in the file are shown, such as mapping email address or other basic data.

> You keep referencing NameID, but what I see is NameIdentifier, and I’m confused about that.

The log refers to NameIdentifier because the software dates to SAML 1.1, and that's what it was called (and because that log format is outdated and is nothing but an anachronism at this point waiting to be replaced). SAML 2.0 has been the standard for 12 years now and the element there is named NameID, so when I speak or write, my tendency is to refer to that name. Functionally speaking they're the same thing in terms of mapping data.

-- Scott