Shib IdP Proxying to another IdP help

[Cantor, Scott]

On 2/22/22, 5:15 PM, "users on behalf of Brent Goebel" <users-bounces at shibboleth.net on behalf of Brent.Goebel at du.edu> wrote:

>    I can change the names being send as you recommended. So I went ahead and made the names unique. I
> went to the IdP-NEW configuration and updated the attributes to be released to Shib-IdP adding "PG" to the 
> front of them (employeeID changed to PGemployeeID). 

That isn't what "non-unique" means. SAML from LDAP means URN names with the OIDs in them. Those are the names the IdP expects for basic LDAP attributes if you want to avoid custom rules. Making up names means custom rules. That's what the log is telling you.

A unique name is a URI and the standard dictates what the names are for LDAP sourced data.

What you call them internally to the IdP is irrelevant, and not what I was talking about. You *want* them to be called the same things the IdP has always called them, that's what allows them to get shipped outbound automatically by applying the same default rules in the other direction.

-- Scott