Shib SP attribute aliases

[Steven Premeau]

It looks like this might be a feature, handling how the replace function
deals with a non-match.

>From (maint-3.5) plugins/TransformAttributeResolver.cpp (quoting lines
218-219):

    // For some reason, it returns the source string if the match doesn't
succeed.
    if (!XMLString::equals(destval, srcval.get())) {
        ...
    }
else {
XMLString::release(&destval);
}

Steve.

On Thu, Sep 18, 2025 at 4:09 PM Steven Premeau <steven.premeau at maine.edu>
wrote:

> Keith -
>
>   I was able to replicate your issue in my sandbox environment... after
> poking around for a while I was able to get the desired output by adding a
> space on either side (or both sides, for symmetry) of the $1, as below:
>
>             <Regex match="^(.+)$" dest="foo"> $1 </Regex>
>
>  The extra white space appears to be trimmed out when I view the
> transformed attribute in the output of /Shibboleth.sso/Session, but I am
> not 100% positive that is the case.
>
>   I'll defer to others if this is a bug or a feature.
>
> Steve.
>
> On Thu, Sep 18, 2025 at 2:59 PM Wessel, Keith via users <
> users at shibboleth.net> wrote:
>
>> Hi, all,
>>
>> We've got an SP that needs to have a SAML 2 attribute made available
>> multiple times under different environment variables. I know the aliases
>> attribute on the <Attribute> element of the attribute map is deprecated,
>> but I'm confused on the right way to do this.
>>
>> Gemini (heaven help us all) keeps telling me I can just have multiple
>> entries in the attribute map. I think it's confused... Shocking, I know. I
>> know this works for mapping multiple SAML 2 names to the same internal ID
>> to handle working with different IdPs to map different names from outside
>> to a common place, but I don't think this works for mapping a single SAML 2
>> attribute to multiple internal ids. My test made it look like the SP
>> matched the first entry it found with the given SAML 2 name, ignoring
>> subsequent mappings to other IDs.
>>
>> So, we tried the Transform AttributeResolver in shibboleth2.xml after
>> adding the plugins.so library to the OutOfProcess block. We added this
>> inside the shibboleth2.xml:
>>
>>         <AttributeResolver type="Transform" source="uid">
>>
>>             <Regex match="^(.+)$" dest="foo">$1</Regex>
>>
>>         </AttributeResolver>
>>
>> This produces, oddly, an empty env var called foo instead of one
>> containing my uid.
>>
>> This also seems a little overly complex to just alias an attribute.
>>
>> What's the best way to make an attribute available under multiple IDs if
>> we aren't doing any transforms on the values? And if it is the Transform
>> plugin, what might I be doing wrong?
>>
>> Thanks,
>> Keith
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250918/67fa2c38/attachment.htm>