Shib SP attribute aliases

[Wessel, Keith]

Hi, all,

We've got an SP that needs to have a SAML 2 attribute made available multiple times under different environment variables. I know the aliases attribute on the <Attribute> element of the attribute map is deprecated, but I'm confused on the right way to do this.

Gemini (heaven help us all) keeps telling me I can just have multiple entries in the attribute map. I think it's confused... Shocking, I know. I know this works for mapping multiple SAML 2 names to the same internal ID to handle working with different IdPs to map different names from outside to a common place, but I don't think this works for mapping a single SAML 2 attribute to multiple internal ids. My test made it look like the SP matched the first entry it found with the given SAML 2 name, ignoring subsequent mappings to other IDs.

So, we tried the Transform AttributeResolver in shibboleth2.xml after adding the plugins.so library to the OutOfProcess block. We added this inside the shibboleth2.xml:

        <AttributeResolver type="Transform" source="uid">                                                               
            <Regex match="^(.+)$" dest="foo">$1</Regex>                                                                    
        </AttributeResolver>

This produces, oddly, an empty env var called foo instead of one containing my uid.

This also seems a little overly complex to just alias an attribute.

What's the best way to make an attribute available under multiple IDs if we aren't doing any transforms on the values? And if it is the Transform plugin, what might I be doing wrong?

Thanks,
Keith