Shib Idv v4.3.3 with OIDC

[Peter Schober]

Hall, Gerry via users <users at shibboleth.net> [2024-10-03 15:34 CEST]:
> I have added OIDC support to our Shibboleth IdP (v4.3.3) and
> everything appears to work as expected.

Why would you add new functionality to an old, unsupported release of
the software? Upgrade to v5 first, then add new features.
(If there's a sudden, "urgent", need for OIDC support use that need to
get the time to upgrade the IDP first.)

> <!--  Works but adds @emory.edu scope -->
> <AttributeDefinition id="oidc_serialNumber" xsi:type="Scoped" scope="%{idp.scope}"
>         activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
>     <InputAttributeDefinition ref="serialNumber" />
>     <AttributeEncoder xsi:type="oidc:OIDCScopedString" name="sub" />
> </AttributeDefinition>
> 
> But what I really need is the just the serialNumber minus the scope.
> I have tried several configurations without success.
> Here is one example:
> 
> <!— Does not work.  Nothing is passed for the oidc_serialNumber à
> <AttributeDefinition id="oidc_serialNumber" xsi:type="Simple" >
>     <InputAttributeDefinition ref="serialNumber" />
>     <AttributeEncoder xsi:type="oidc:OIDCString" name="oidc_serialNumber" />
> </AttributeDefinition>

Note that you're also changing the claim to stick this into.
Does it "work" when releasing it as sub claim (as per your above
example)? Then it's merely a question of releasing the attribute/claim
as needed.

> I have also tried just passing the serialNumber which also does not
> work.

I too struggle(d) with finding the right approach to getting custom
claims released. At least with the OIDC OP plugin I'm using with IDPv5
there's a conf/oidc-attribute-filter.xml you can start from.

-peter