Custom ID Decoder for Attribute Query

[Wolff, Pierre]

Hello,

in our attribute-resolver we are currently using a HTTP DataConnector to get a serviceProvider- and user-specific ID via a SOAP
Webservice.
Now we want to use that ID via the backchannel attribute query. Which already works for us in general with storedId pairwise-ids,
generated and stored by the IdP internally.
As far as I understand the process, we need to define a reverse-mapping for the ID back to the principal name via the
subject-c14n.xml config (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507773/NameIDConsumptionConfiguration).
Our idea is to write a custom NameIDDecoder java bean for the resolution via webservice, and add that to the
SAMLSubjectCanonicalizationFlows. I assume we cannot just use the existing structure from the attribute-resolver HTTP Connector?
For a number of reasons it is very convenient in our setting to generate and have those ID's in our system behind this webservice,
rather than in a database of the IdP.
Before we try to implement that we want to ask:
Is this the/a correct place to solve that problem? Is there maybe already a decoder out there that does that? Do you have any useful
advice for us?

Best regards,
Pierre

-- 
Pierre Wolff

IT Center
Gruppe: Identity & Access Management
Abteilung: Systeme und Betrieb
RWTH Aachen University
Seffenter Weg 23
52074 Aachen
Tel: +49 241 80 29794
wolff at itc.rwth-aachen.de
www.itc.rwth-aachen.de

Social Media:
www.itc.rwth-aachen.de/socialmedia

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7316 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260413/637c5cc8/attachment.p7s>