Shib IdP Proxying to another IdP help

[Cantor, Scott]

On 2/22/22, 5:31 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>    What you call them internally to the IdP is irrelevant, and not what I was talking about. You *want* them to
> be called the same things the IdP has always called them, that's what allows them to get shipped outbound
> automatically by applying the same default rules in the other direction.

Concretely...take "givenName". If you want to handle it of the box, then you need it to be named with a URI in SAML of "urn:oid:2.5.4.42" and the appropriate NameFormat constant, and you want to map and process it internally as "givenName".

If you don't do that, then you need new rules.

If you want to support an alternative name inbound but standard outbound, then you add a rule that maps whatever is coming in into the internal ID of "givenName" and the outbound step will be defaulted. If you need alternative outbound, you map "givenName" to whatever else it needs to be called.

-- Scott