Help setting REMOTE_USER to attribute NameIdentifier - Linux / Apache / SP 2.6

[Cantor, Scott]

On 6/9/17, 12:32 PM, "users on behalf of Adam von Nieda" <users-bounces at shibboleth.net on behalf of adam at vonnieda.org> wrote:

> You're right, that’s why I said I was changing the subject line. Didn’t mean to make things worse. 

That is not my point. What you seem to have changed is the XML itself that you're trying to map from, and I have no idea what you're even trying to process now.

> In the end, the question I’m asking is the same. All I’m trying to do is populate the REMOTE_USER header variable with the
> username returned by the IdP, which is stored in the NameID attribute, right?

The NameID is an XML element, not an "attribute". The value inside the element is what you're trying to get at.

Attribute is a tremendously overloaded term. SAML Attributes are inside AttributeStatements inside the Assertion. The SP operates on SAML Attributes. It hates NameIDs because they are evil and awful and painful and misused, but regardless it can map them as well.

What it creates from either source are "local" attributes (see? overloaded) with internal names assigned by the mapping rules you create, and the rest of the SP settings operate on those names, or by creating request content that's based on those names.

> Isn’t there a simple example of the configuration needed to do this? 

The attribute-map file is littered with them, and I couldn't possibly do that when I no longer have any idea what actual SAML you're trying to map from.

-- Scott