[EXTERNAL] Re: unable to capture eppn information from SAML2/POST at SP

[O'Quinn, Dennis]

HI Peter, thanks, I probably should have specified, I am working from the SP end, I have little control over the IdP...  2 different entities....  That said,

NOTE: we are not an educational entity, does the 'edu' prefix on all this stuff = "education"?  and if so, I did not realize that this was significant.  I assumed all the references to eduTHIS and eduTHAT were just artifacts from the environment in which SAML/Shibboleth was primarily used vs. something we had to code our values to....

So:
> 1. "eppn" is not the correct name (that would be "urn:oid:1.3.6.1.4.1.5923.1.1.1.6"), at least if you meant https://urldefense.proofpoint.com/v2/url?u=http-3A__macedir.org_specs_eduperson_- 
>      23eduPersonPrincipalName&d=DwICAg&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=vo-2vYcvJvuFFUpNTu9XBjeEqA0RTgNsbUAG2JN1cTg&s=rYb6YKQeocsmrSw2fsmhLwyQ9VMq1sdUVzFapKS6GRw&e=

Are you saying I need to go back to my IdP team and have them convert that attribute to
>                 <saml:Attribute Name=" urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat=" urn:oasis:names:tc:SAML:2.0:attrname-format:uri ">
>                     <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">dxo5ic1</saml:AttributeValue>
>                 </saml:Attribute>

>  3. eduPersonPrincipalName is defined to be scoped, as in "foo at example.org", so the attribute value is also wrong.

*now* I know what 'eppn' stands for... Thanks for that.  However, we are not looking for an email address in return, we are only looking for the users LDAP ID (in this particular example the string 'dxo5ic1') and or intent is to have the REMOTE_USER field in the headers to be populated with that value.

> <Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"
>     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>     xsi:schemaLocation="urn:mace:shibboleth:2.0:attribute-map
>     /usr/share/xml/shibboleth/shibboleth-2.0-attribute-map.xsd"
>     REMOTE_USER="eppn">

I got the above from a page similar to https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=4358911 (only it did not say 'you are viewing an old version of the page' at the top as this one does....  I could not find the first page where I initially got this info)...

>  The attribute map has no REMOTE_USER XML attribute, you're mixing that up with the shibboleth2.xml config file. Did you try The Fine Documentation?

Not sure what 'The Fine Documentation' is....  But, I am consuming a *lot* of time going through what documentation there is.

> No. You put the nameformat in the "name" parameter (XML attribute).
> Also the attribute your IDP sends is not scoped, so the scoped decode would through it out, if it ever matched (which it doesn't).

This was the name format specified by my IdP.  I am trying to work what he is sending me.  

>  What kind of application using what technology? You shouldn't need to put attributes into Request Headers.

It is what is required and documented for the application.  I am bound by that....

Thanks, Dennis