Change Returned Value for a Service

[Andrew Morgan]

On Wed, 20 Mar 2019, Hugo Slavia wrote:

> This is an odd one.
>
> There is a relatively untrusted service - which requires the 'Email'
> attribute returned -- however, we wish not to return the actual email
> address for this particular service (it will be a scope value of the
> persistent ID).
>
> Is there a way to swap 'mail' out for 'Email' for this particular service?
> Otherwise flow through as expected for other services which consumes the
> attribute?
>
> <resolver:AttributeDefinition id="Email" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="mail">
>        <resolver:Dependency ref="mail" />
>        <resolver:DisplayName xml:lang="en">Email Address</resolver:DisplayName>
>        <resolver:DisplayDescription xml:lang="en">Email Address</resolver:DisplayDescription>
>             <resolver:AttributeEncoder xsi:type="enc:SAML2String"
>             nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
>             name="Email"
>             encodeType="false" />
>     </resolver:AttributeDefinition>

Sure, just create a new attribute in attribute-resolver.xml with a 
different ID that encodes the same name.  For example, we have this 
attribute definition:

     <AttributeDefinition xsi:type="Simple" id="eppn_as_mail" sourceAttributeID="eduPersonPrincipalName">
         <Dependency ref="myLDAP" />
         <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
     </AttributeDefinition>

Then release it to the specific SP.  Make sure you don't release the 
standard mail attribute to the same SP, though.

 	Andy