alternate attributeSourceIDs for a given nameid format

[Baron Fujimoto]

We have an SP that claims to need an emailAddress NameIDFormat. We can
currently achieve this with an entry in our saml-nameid.xml conf file like:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'attrEmail_real'} }" />

However, for this SP now claims that for a separate instance of their SP,
they need users with IDs that do not share the same domain name. We may be
able to synthesize a new email-like attribute, say, attrEmail_2, but is
there a way to get use it as an alternate emailAddress NameIDFormat for
this just this SP? E.g, something like

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'attrEmail_synth'} }" />

It seems like the nameid encoder(?) only pays attention to the format
though, and not the attributeSourceId, and thus select one or other?

Perhaps some approach using an activation condition, or other suggestions
or advice?

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210304/0f068945/attachment.htm>