PersonImmutableID configuration

[Steve Herrera]

Hello,
Does anyone have any experience working with the SP ADP? They are IDP
initiated so unlike all our other SP's that give us the URL to hit and that
initiates the request to us, the users hit the IDP first and then pushes to
the SP.  I have that part working. Where I'm having trouble is
understanding 2 pieces of information they need to make this work.

One is the attribute type that they require. They call it
"PersonImmutableID". I have that being populated with the correct
information Employee number as agreed upon but their side views it as null.
Is there something I need to do to make that attribute immutable?  Here is
how I have it defined in attribute-resolver.xml file:

<AttributeDefinition xsi:type="Simple" id="PersonImmutableID">

        <InputDataConnector ref="myLDAP" attributeNames="employeeNumber"/>

        <AttributeEncoder xsi:type="SAML1String" name=
"urn:mace:dir:attribute-def:employeeNumber" />

        <AttributeEncoder xsi:type="SAML2String" name=
"urn:oid:2.16.840.1.113730.3.1.3" friendlyName="employeeNumber" />
    </AttributeDefinition>

The second part is what they call the "Relay State" url. They provided a
URL labeled Relay State but I'm not sure how to configure it . They are
checking for that in the response they receive. In my relying-party.xml, I
have to configure a url that is labeled "Audience" That is what creates the
handshake between them and us. We know our communication is making it to
them because it hits their server logs and all the other handshake checks
are correct except these two.

Thanks

Steve Herrera
System Administration
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201007/d8a4fffd/attachment.htm>