Pick attributes depending on the proxy

[Matthew Slowe]

On 08/12/2022 08:36, Ward Poelmans via users wrote:
> Hi,
> 
> My situation is that I have Shibboleth acting as a proxy for 2 AAD 
> tenants. So far it works using a discovery service in between.
> 
> The issue is that I need to deliver a uid attribute to the SP but the 
> value of this field has a different source attribute in the two AAD 
> tenants.
> 
> For the first one I need to use the 'OnPremSamAccName' field, for the 
> second the 'AzureName'. I'm struggling how to get this done without 
> fully blown scripting (if that is avoidable). I found the relyingParties 
> properties for attribute definition but it does not seem to do what I 
> hoped: specify the entityID of one of the AAD tenant I'm proxying too 
> doesn't trigger it. What exactly is the relyingParty in this context?
> 
> Is there any way of doing this other then using a ScriptedAttribute?

At a guess you could try either one of:

1. In the Attribute Resolver, instantiate both incoming attributes 
independently (as dependancyOnly="true") and then combine them into an 
output attribute by referencing both inbound ones as 
InputAttributeDefinitions. You'd have to be _very_ sure you wouldn't get 
a situation where both upstream attributes could be populated.

Something like (untested):

<AttributeDefinition xsi:type="SubjectDerivedAttribute" id="attr1" 
dependencyOnly="true" principalAttributeName="upstream1-attr" />

<AttributeDefinition xsi:type="SubjectDerivedAttribute" id="attr2" 
dependencyOnly="true" principalAttributeName="upstream2-attr" />

<AttributeDefinition xsi:type="Simple" id="output">
   <InputAttributeDefinition ref="attr1" />
   <InputAttributeDefinition ref="attr2" />
</AttributeDefinition>

or

2. Use the Attribute Registry to map both incoming attributes to the 
same IDP attribute (also untested!):

<bean parent="shibboleth.TranscodingProperties">
     <property name="properties">
         <props merge="true">
             <prop key="id">idp-attr</prop>
             <prop key="saml2.name">upstream1-attr</prop>
            ...
         </props>
     </property>
</bean>

<bean parent="shibboleth.TranscodingProperties">
     <property name="properties">
         <props merge="true">
             <prop key="id">idp-attr</prop>
             <prop key="saml2.name">upstream2-attr</prop>
            ...
         </props>
     </property>
</bean>

Not sure if either of these will work in practice...!

-- 
Matthew Slowe [he/him] (GPG: 0x6BE0CF7D04600314)
Senior Technical Consultant and Support specialist, Jisc
Team: 01235 822185
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG