unable to capture eppn information from SAML2/POST at SP

[Cantor, Scott]

> I have simplified my attribute map to the following:
> 
> <Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"
>     REMOTE_USER="eppn">

I'm pretty sure that's "broken" rather than simplified, I don't see REMOTE_USER in the schema and didn't think it was a valid setting. Depends whether you tell it to validate that particular bit of XML or not, but if you did it wouldn't load and would log that at startup. Otherwise I would guess it should be ok, but that isn't where REMOTE_USER is determined, that's set in shibboleth2.xml

So my guess would be you are validating (which is what the default shipping settings do) and that would be the most likely problem.

The rule itself looks fine such as it is, though that certainly is not eduPersonPrincipalName as defined by the relevant authority over what that attribute means. I wouldn't advise using the "eppn" shorthand just out of sheer avoidance of confusion if you use it for something you're making up locally, but it's your decision.

-- Scott