IDP proxing for vendors non-DS/Wayf capabilities

[Jehan PROCACCIA]

I found what was missing for other than Principal (mail/uid)  pass-through  attributes , remember, I was loosing givenName and sn attributes from upstreamIDP through IDP-Proxy and finally to SP . 

The solution was in the Doc :  https://wiki.shibboleth.net/confluence/display/IDP4/SubjectDataConnector

since I added in IPD-proxy attribute-resolver.xml that dataConnector :

<DataConnector id="passthroughAttributes" xsi:type="Subject" exportAttributes="givenName sn" />

Now givenName and sn attributes are well passing through ;-)
there was no need to add to that Dataconnector a derivated AttributeDefinition , which I've done in the 1srt place but then commented and it still worked fine,  strange ...!? :
<!-- <AttributeDefinition xsi:type="Simple" id="sn">
    <InputDataConnector ref="passthroughAttributes" attributeNames="sn" />
</AttributeDefinition> --> 

Nate, your're right to "hold out the pole" (from google translate, i hope it's correct..) for signet.id offering, I'll keep that in my mind if needed. 

Regards 

Jehan.


----- Mail original -----
De: "Nate Klingenstein" <ndk at signet.id>
À: "users" <users at shibboleth.net>
Envoyé: Jeudi 4 Février 2021 22:09:10
Objet: RE: IDP proxing for vendors non-DS/Wayf capabilities

Jehan,

> <AttributeDefinition id="canonicalName" xsi:type="SubjectDerivedAttribute"
>    forCanonicalization="true"
>    principalAttributeName="mail" />

It's been awhile and I don't have that container in front of me, but if I recall, attributes marked forCanonicalization only got released when they're the end result of canonicalization.  Make sure that's false for the other attributes.

> Nate, I'll probably come back later on (next weeks/mounth)  about the  discoveryFunctions you mention for "multi-tenant" applications, for my next shibboleth IDP integration (MS-365 ...)

We'd be glad to help, but this gets close to some of our service offerings, so we may not be able to do so on list.  Families need food...

Best wishes,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net