Request for SAML attributes mapping configuration between Okta to Shibboleth IDP

[S, Kalidasan]

Hi Team,

As part of our recent client engagement, we need to enable SAML proxy for Shibboleth IDP and configure Okta as upstream IDP with all attributes coming into Shibboleth user schema from Okta's SAML assertion(instead of obtaining this from external directory like LDAP).

So far, we achieved the SSO to work as expected and the SSO redirection is happening via Okta IDP. Also referred below documentations and related references for attribute mappings
Using SAML Proxying to another IdP - Shibboleth Knowledge Base - Confluence<https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP>
AttributeDefinitionConfiguration - Identity Provider 4 - Confluence<https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631550/AttributeDefinitionConfiguration>

We tried to use "xsi:type=StoredSAML" to store the SAML attribute and utilized the same for mapping against the attribute IDs at Shibboleth end. But we could find in one of the articles that StoredSAML type is deprecated from V4.3.1 onwards.
Also, currently this is setup in a way that the Shibboleth attributes are directly pulled from a LDAP directory post authentication against Proxy AD servers.
Our version: V4.3.3

Kindly help us with the alternate configuration to achieve the required attribute mappings which stores and maps the Incoming SAML attributes to Shibboleth user schema.
Please reach out to me or people in CC for any additional details.

Thanks and Regards
Kalidasan S
Advisory - Senior Solution Advisor
Cyber IAM(Okta) | Deloitte US India Risk and Financial Advisory
kalids at deloitte.com<mailto:kalids at deloitte.com> | www.deloitte.com<http://www.deloitte.com/>


This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

v.E.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241030/2b5107cc/attachment.htm>