Help setting REMOTE_USER to attribute NameIdentifier - Linux / Apache / SP 2.6

[Cantor, Scott]

On 6/9/17, 1:54 PM, "users on behalf of Adam von Nieda" <users-bounces at shibboleth.net on behalf of adam at vonnieda.org> wrote:

> I know from the shibboleth2.xml that if a mapping in the attribute-map.xml populates “eppn” for example, then REMOTE_USER
> will get set. What I don’t know is what I’m supposed to add to the attribute-map.xml to make that happen for me.

Rules in the file apply based on the SAML Attribute Name or a SAML NameID/NameIdentifier Format. "Name" and "Format" are XML attributes in the respective XML elements in the message. The rule maps the matching data to the local attribute named by the "id" XML attribute in the rule.

REMOTE_USER then references the "id".

The rule for "eppn" maps a SAML Attribute with a Name matching the OID URN for eduPersonPrincipalName and sticks it in local attribute "eppn". Which REMOTE_USER references.

> There’s some piece of information that it seems like you’re expecting from me that I don’t have, or don’t know how to get in
> order to do that mapping. 

You can't map in a NameID in unless you know the Format XML attribute used. Which you posted, and I have no specific memory other than that it was some string, and I said "well, that's an illegal value, but you can use it if you're willing to accept broken SAML". Whatever it is, that's what goes in the rule.

> if we assume that my attribute-map.xml is default as distributed, is there something I need to get from my IdP admin in order to
> complete the mapping entry? Do I need to dump SAML, or what? 

You need the NameID Format used, and if it's an illegal one, you need to make a philosophical decision as to whether running security software and accepting data improperly formatted constructed and specified is a good idea. My opinion on that doesn't really bear on what the software will allow you to do.

-- Scott