mapped attribute

[Andrew Morgan]

On Fri, 31 Mar 2017, Mary Wiegand wrote:

> Hi,
>
> I'm trying to map an attribute to a specific output using the following 
> instructions: 
> https://wiki.shibboleth.net/confluence/display/IDP30/MappedAttributeDefinition
>
> I'm sure I'm missing something but, does anyone know if you have to use 
> the two value maps or if you can use just one? Does the dependency have 
> to be the id of the attribute you're trying to map? And for the 
> AttributeEncoder what should the name be pointing to since the return 
> value isn't a real attribute in my ad?

Mary,

Here is an example of a Mapped attribute definition we are using:

     <AttributeDefinition xsi:type="Mapped" id="entitlement_synacor" sourceAttributeID="ismemberof">
         <Dependency ref="ONIDLDAP" />
         <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
         <ValueMap>
             <ReturnValue>urn:mace:oregonstate.edu:entitlement:pac12tv-mobile-access</ReturnValue>
             <SourceValue ignoreCase="true">cn=pac12tv,ou=uhds,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu</SourceValue>
         </ValueMap>
     </AttributeDefinition>

This looks at the values of "ismemberof" from our LDAP data connector.  If 
the specified group is found, the attribute "entitlement_synacor" is 
populated with an entitlement value and encoded as a SAML2String with the 
eduPersonEntitlement attribute name.  In our attribute-filter.xml, we 
release this to a specific SP.

Let me know if you have any questions.

Thanks,
 	Andy