Azure AD proxy - passing claims from Shib

[Ramaiah, Vanna G.]

In this case,  Azure AD should handle the authentication, but all other attributes should be passed by Shib as usual using the proxied-uid attribute. Is this even possible?

I am configuring it this way mainly for 2 reasons:

  1.  minimize any change on service provider side might be using attributes in  different attribute names.
  2.  I am not sure how to pass targeted and computed ids from Azure AD.

How does subject canonicalization work? Shib get the uid from the subject (defined in attribute filter policy) and transforms to proxied-uid.

<AttributeDefinition xsi:type="SubjectDerivedAttribute"
    forCanonicalization="true"
    principalAttributeName="uid"
    id="proxied-uid"
    />

Once attribute sourced subject is set, what happens next? Does it use this attribute "proxied-uid", to do ldap connection (defined in reolver file) to look for other attributes like name, email, etc.?

<util:list id="shibboleth.c14n.attribute.AttributesToResolve">
    <value>proxied-uid</value>
</util:list>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250513/f832eef6/attachment.htm>