<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>>> <ApplicationDefaults id="default" entityID="yada yada" policyId="default" signing="false" encryption="false" REMOTE_USER="uid eppn netid" ></div>
<div><br>
</div>
<div>My understanding is, when IdP asserts more than one, first available (in that order) will be passed in REMOTE_USER.</div>
<div><br>
</div>
<div>Datta</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Adam Cohen <<a href="mailto:adamcohen@berkeley.edu">adamcohen@berkeley.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Thu, 1 Mar 2012 14:31:32 -0800<br>
<span style="font-weight:bold">To: </span><<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>coordinating an SP with multiple IdPs<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Greetings,
<div>Im working on a new SP implementation which needs to work with multiple IdPs. The application behind the SP needs a single identifier for the user which it expects to find in the REMOTE_USER http header after authentication. </div>
<div><br>
</div>
<div>The different IdPs are asserting different attributes. One site uses "uid", another uses "ePPN" and there may be a third. The value present in any of these attributes will be acceptable to the SP, but I cannot figure out how to tell my SP to map the
appropriate IdP attribute name to the REMOTE_USER target.</div>
<div><br>
</div>
<div>My best guess was to do it with the <ApplicationDefaults> stanza in shibboleth2.xml: </div>
<div>
<div> <ApplicationDefaults id="default" entityID="yada yada" policyId="default" signing="false" encryption="false" REMOTE_USER="uid eppn netid" ></div>
</div>
<div><br>
</div>
<div>but its unclear to me what will happen if an IdP asserted more than one of these values…</div>
<div><br>
</div>
<div>It doesn't look like the attribute-map.xml is the right place either - although the asserted attribute has to be defined there for each IdP, there's nothing that seems to establish the connection of the attribute to the http header that is passed to the
SP.</div>
<div><br>
</div>
<div>Any pointers to documentation or an example of this configuration would be appreciated</div>
<div><br>
</div>
<div>
<div apple-content-edited="true"><span class="Apple-style-span" style="font-family: Helvetica; ">
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">
<font class="Apple-style-span" face="Courier New" size="3"><span class="Apple-style-span" style="font-size: 11px; ">-- </span></font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">
<font class="Apple-style-span" face="Courier New" size="3"><span class="Apple-style-span" style="font-size: 11px; ">Adam Cohen / IT Manager</span></font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">
<font class="Apple-style-span" face="Courier New" size="3"><span class="Apple-style-span" style="font-size: 11px; ">Energy Biosciences Institute / UC Berkeley</span></font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">
<font class="Apple-style-span" face="Courier New" size="3"><span class="Apple-style-span" style="font-size: 11px; ">109 Calvin Lab / 510-642-7709</span></font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">
<font class="Apple-style-span" face="Courier New" size="3"><span class="Apple-style-span" style="font-size: 11px; "><a href="http://www.energybiosciencesinstitute.org">http://www.energybiosciencesinstitute.org</a></span></font></div>
</span></div>
<br>
</div>
</div>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span>
</body>
</html>