Igloo Software

[Peter Schober]

* Klingenstein, Nate <nklingenstein at calstate.edu> [2018-01-05 11:06]:
> They're giving you the ability to specify the precise path to
> something in the assertion that you want to use for that purpose.
> I've never seen that before.

Me neither. And while using XPath directly gives you a lot of power
this would require more settings to be useful, mainly one to map
(standard) XML Namespaces to (arbitrary) prefixes as used in the
processed XML.

> There will be no defaults for Shibboleth since it depends on what
> you send, but a best practice might be:
> 
> Identifier
> 
> /samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml:AttributeValue
> 
> (eduPersonPrincipalName on the wire)

While that should help the OP identifying the desired attribute values
my Shibboleth IDP v3.3.2 uses "saml2p" as prefix for the SAML protocol
namespace (as indicated in the XML itself, of course, with
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol") and "saml2" for
the SAML assertion namespace
(xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion").

So for the IDPv3 the above should probably be (after decryption, but
it's probably safe to assume the SP in question doesn't even support
encryption) -- changing only the prefixes used:

> /saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml2:AttributeValue

HTH,
-peter