Proxy IdP hybrid question local and remote IdPs

[Cantor, Scott]

>    If my local IdP canonicalizes subjects based on uid (unscoped username) and the remote IdP canonicalizes subjects
> based on employeeNumber, and the remote IdP entities and metadata do not exist in my local IdP, can I take the
> remote IdP assertion and passthrough those attributes to the SP?

Yes. Anything extracted is still part of the Java Subject and is accessible to the resolver later, regardless of how c14n is done. 

I will take a look at possible approaches to simplifying c14n eventually. A passthrough with no local state to map probably doesn't care much what the logged username is. I can probably build in a hook to short-circuit c14n by just populating it from something in the assertion directly. I can't start by taking shortcuts because that would prevent other use cases from working properly.

-- Scott