Shib SP attribute aliases

[Steven Premeau]

Keith -

  I was able to replicate your issue in my sandbox environment... after
poking around for a while I was able to get the desired output by adding a
space on either side (or both sides, for symmetry) of the $1, as below:

            <Regex match="^(.+)$" dest="foo"> $1 </Regex>

 The extra white space appears to be trimmed out when I view the
transformed attribute in the output of /Shibboleth.sso/Session, but I am
not 100% positive that is the case.

  I'll defer to others if this is a bug or a feature.

Steve.

On Thu, Sep 18, 2025 at 2:59 PM Wessel, Keith via users <
users at shibboleth.net> wrote:

> Hi, all,
>
> We've got an SP that needs to have a SAML 2 attribute made available
> multiple times under different environment variables. I know the aliases
> attribute on the <Attribute> element of the attribute map is deprecated,
> but I'm confused on the right way to do this.
>
> Gemini (heaven help us all) keeps telling me I can just have multiple
> entries in the attribute map. I think it's confused... Shocking, I know. I
> know this works for mapping multiple SAML 2 names to the same internal ID
> to handle working with different IdPs to map different names from outside
> to a common place, but I don't think this works for mapping a single SAML 2
> attribute to multiple internal ids. My test made it look like the SP
> matched the first entry it found with the given SAML 2 name, ignoring
> subsequent mappings to other IDs.
>
> So, we tried the Transform AttributeResolver in shibboleth2.xml after
> adding the plugins.so library to the OutOfProcess block. We added this
> inside the shibboleth2.xml:
>
>         <AttributeResolver type="Transform" source="uid">
>
>             <Regex match="^(.+)$" dest="foo">$1</Regex>
>
>         </AttributeResolver>
>
> This produces, oddly, an empty env var called foo instead of one
> containing my uid.
>
> This also seems a little overly complex to just alias an attribute.
>
> What's the best way to make an attribute available under multiple IDs if
> we aren't doing any transforms on the values? And if it is the Transform
> plugin, what might I be doing wrong?
>
> Thanks,
> Keith
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250918/2834a4be/attachment.htm>