addDefaultPrincipals vs PrincipalProxyResponseMappings

[Cantor, Scott]

On 2/24/21, 3:23 PM, "users on behalf of Tony Skalski via users" <users-bounces at shibboleth.net on behalf of users at shibboleth.net> wrote:

>    I presume the second option is the preferred method. Before I promote this to production, is there anything wrong with
> this configuration, or anything that should be done differently? Thanks!

I can't tell you that it's right or wrong to map "I won't tell you what I did" to "This is what I did", but if you feel comfortable doing that, the mapping table is the right way.

The addDefaultPrincipals setting is off for SAML because it assumes you'll either echo through what you got or remap it and that it wouldn't be a fixed set. If it's a fixed value then it's pretty much interchangeable which way you do it.

-- Scott