forCanonicalization and attribute resolution

[Nate Klingenstein]

All,

This had me tied up in knots for days until I guessed at the eventual solution and wanted to verify that I came out with the correct answer.

I'm trying to take ePPN and use it both for Subject canonicalization and also encode the proxied version as an attribute.  With a single AttributeDefinition with forCanonicalization="true", I was unable to get the value to be sent as an attribute as well.

However, if I create a second, identical proxied ePPN AttributeDefinition(with an encoder -- it did not matter whether I provided an encoder with forCanonicalization="true") with forCanonicalization="false", I'm able to get the value sent as an attribute as well as using it for c14n/Subject creation.

The final config in attribute-resolver.xml looked like:

    <AttributeDefinition id="authneppn" xsi:type="SubjectDerivedAttribute"
            forCanonicalization="true"
            principalAttributeName="eduPersonPrincipalName">
    </AttributeDefinition>

    <AttributeDefinition id="proxyeppn" xsi:type="SubjectDerivedAttribute"
            forCanonicalization="false"
            principalAttributeName="eduPersonPrincipalName">
                 <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" friendlyName="custom:id" encodeType="false" />
     </AttributeDefinition>

Is my interpretation of all of this correct?  If so, it's a bit confusing and counterintuitive at first, but makes sense if I think like code.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id