Igloo Software

[Hugo Slavia]

Thanks Nate, Peter!

Here is the working setting  :)


Identifier Path
/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml2:AttributeValue


Session Index Path
/saml2p:Response/saml2:Assertion/saml2:AuthnStatement


Email Path
/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="urn:oid:0.9.2342.19200300.100.1.3"]/saml2:AttributeValue


First Name Path
/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="urn:oid:2.5.4.42"]/saml2:AttributeValue


Last Name Path
/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="urn:oid:2.5.4.4]/saml2:AttributeValue


On Mon, Jan 8, 2018 at 10:03 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Klingenstein, Nate <nklingenstein at calstate.edu> [2018-01-05 11:06]:
> > They're giving you the ability to specify the precise path to
> > something in the assertion that you want to use for that purpose.
> > I've never seen that before.
>
> Me neither. And while using XPath directly gives you a lot of power
> this would require more settings to be useful, mainly one to map
> (standard) XML Namespaces to (arbitrary) prefixes as used in the
> processed XML.
>
> > There will be no defaults for Shibboleth since it depends on what
> > you send, but a best practice might be:
> >
> > Identifier
> >
> > /samlp:Response/saml:Assertion/saml:AttributeStatement/saml:
> Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml:AttributeValue
> >
> > (eduPersonPrincipalName on the wire)
>
> While that should help the OP identifying the desired attribute values
> my Shibboleth IDP v3.3.2 uses "saml2p" as prefix for the SAML protocol
> namespace (as indicated in the XML itself, of course, with
> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol") and "saml2" for
> the SAML assertion namespace
> (xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion").
>
> So for the IDPv3 the above should probably be (after decryption, but
> it's probably safe to assume the SP in question doesn't even support
> encryption) -- changing only the prefixes used:
>
> > /saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:
> Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml2:AttributeValue
>
> HTH,
> -peter
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180109/62d3ac69/attachment-0001.html>