alternate attributeSourceIDs for a given nameid format

[Lipscomb, Gary]

Try something like this

  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'attrEmail_real'} }">
        <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{SP entityID}}" />
         </property>
</bean>

Gary

From: users <users-bounces at shibboleth.net> On Behalf Of Baron Fujimoto
Sent: Friday, 5 March 2021 13:20
To: Shib Users <users at shibboleth.net>
Subject: alternate attributeSourceIDs for a given nameid format

We have an SP that claims to need an emailAddress NameIDFormat. We can currently achieve this with an entry in our saml-nameid.xml conf file like:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'attrEmail_real'} }" />

However, for this SP now claims that for a separate instance of their SP, they need users with IDs that do not share the same domain name. We may be able to synthesize a new email-like attribute, say, attrEmail_2, but is there a way to get use it as an alternate emailAddress NameIDFormat for this just this SP? E.g, something like

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'attrEmail_synth'} }" />

It seems like the nameid encoder(?) only pays attention to the format though, and not the attributeSourceId, and thus select one or other?

Perhaps some approach using an activation condition, or other suggestions or advice?

--
Baron Fujimoto <baron at hawaii.edu<mailto:baron at hawaii.edu>> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210305/1c2b6219/attachment.htm>