mapping attributes

[IAM David Bantz]

Scott described proper behavior and coordination between IdP and SP.
However there are intransigent SPs that expect the SAML to express
something in the SP's made-up name space, such as a particular name or
friendlyName in the assertion. You can (mis-)use the IdP to send something
like they expect (after admonishing the SP and failing to get them to cast
the scales from their eyes) by adding an attribute with non-standard
AttributeEncoder in the attribute-resolver.mxl using the name and/or
friendlyName they require, and releasing that attribute to the miscreant SP
in attribute-filter.xml.

David Bantz

On Wed, Mar 29, 2017 at 8:09 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/29/17, 12:06 PM, "users on behalf of Mary Wiegand" <
> users-bounces at shibboleth.net on behalf of mwiegand at bastyr.edu> wrote:
>
> > Has anyone run into an issue where they needed ldap attributes to show
> up as something else entirely to the SP?
>
> The SP doesn't see any LDAP attributes, it sees SAML, and only through a
> mapping layer that's entirely up to the SP. In other words, this is how it
> works, already.
>
> > I’m expecting that I need to map my attribute in the filter so that is
> displays as what the SP needs to see,
>
> If you're talking about the IdP, no. You have nothing to do with it.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170329/ca5a4956/attachment.html>