IDP v3.3.x - Help on translation PrincipalConnector => NameIDConsumptionConfiguration

[Marco Malavolti]

Hi to all,

GARR is trying to use a Shibboleth IdP (v3.3.x) as an Attribute 
Authority to release specific attributes.

For example we desire to release the "isMemberOf" attribute defined as 
follow in our attribute-resolver.xml (studied for our Grouper instance):

<!-- AttributeDefinition for "isMemberOf" attribute -->
<AttributeDefinitionid="isMemberOf"xsi:type="Simple"sourceAttributeID="isMemberOf">
<Dependencyref="isMemberOfDataConnector"/>
<DisplayNamexml:lang="en">Grouper groups</DisplayName>
<DisplayNamexml:lang="it">Gruppi Grouper</DisplayName>
<DisplayDescriptionxml:lang="en">List of groups retrieved from 
Grouper</DisplayDescription>
<DisplayDescriptionxml:lang="it">Elenco dei gruppi ottenuti da 
Grouper</DisplayDescription>
<AttributeEncoderxsi:type="SAML2String"name="urn:oid:1.2.840.113556.1.666.1"friendlyName="isMemberOf"/>
</AttributeDefinition>
<!-- Grouper Database connector -->
<DataConnectorxsi:type="RelationalDatabase"id="isMemberOfDataConnector">
<ApplicationManagedConnectionjdbcDriver="com.mysql.jdbc.Driver"
jdbcURL="jdbc:mysql://localhost:3306/grouper"
jdbcUserName="###_USER_DB_###"
jdbcPassword="###_SECRET_###"/>
<QueryTemplate>
<![CDATA[
SELECT DISTINCT REPLACE(GROUP_NAME, CONCAT('resources:', 
SUBSTRING_INDEX(SUBSTRING_INDEX('$requestContext.getPeerEntityId()', 
'//', -1), '/', 1), ':'), '') AS GROUP_NAME
FROM grouper_memberships_lw_v
WHERE subject_id LIKE (SELECT subject_id FROM grouper_members WHERE 
subject_identifier0 = '*$requestContext.principalName*')
AND GROUP_NAME LIKE CONCAT('resources:', 
SUBSTRING_INDEX(SUBSTRING_INDEX('$requestContext.getPeerEntityId()', 
'//', -1), '/', 1), '%')
AND list_name = 'members'
AND GROUP_NAME NOT LIKE '%:service:%'
]]>
</QueryTemplate>
<ColumncolumnName="GROUP_NAME"attributeID="isMemberOf"/>
</DataConnector>


We recognize the user throught its 
*eduPersonPrincipalName*(*$requestContext.principalName*) that is sent 
from the SP (where the user is trying the login) to retrieve additional 
attributes from our AA. It has been possible thanks the PrincipalConnector:

<!-- ========================================== -->
<!--Deprecated Principal Connectors -->
<!-- ========================================== -->
<PrincipalConnectorxsi:type="pc:Direct"id="saml2Direct"nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"/> 



As you see, this PrincipalConnector is DEPRECATED and we know that now 
there is a new way to do what we are doing with it: 
NameIDConsumptionConfiguration 
<https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration>

Unfortunately, I have no idea how can I translate the deprecated 
PrincipalConnector into the new NameIDConsumptionConfiguration and I 
need your help to do this and trashing the old stuff.

I hope you can help us to trashing the old and deprecated stuff and, I 
hope, it will be useful for other people.

Thank you all guys!

-- 
Marco Malavolti
Consortium GARR - Servizio IDEM GARR AAI
Via dei Tizii, 6 - I-00185 (ROMA)
CF: 97284570583 - PI:07577141000
Tel.: 02 6448 2507
Skype: marco.mala

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180504/17387cb7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3592 bytes
Desc: Firma crittografica S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20180504/17387cb7/attachment.p7s>