<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Scott</div><div><br></div>Thankyou for the replies and bearing with these questions….<div><br></div><div>If I translate your answer into config would you be so kind as to confirm (or correct!) my understanding:</div><div><br></div><div>1) <i><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13.333333969116211px; background-color: rgb(255, 255, 255); ">Well, you need to define an attribute definition that establishes the</span></i></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><i><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13.333333969116211px; background-color: rgb(255, 255, 255); ">value in some way based on the requestContext.principalName data. There is</span></i></div><div><i><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13.333333969116211px; background-color: rgb(255, 255, 255); ">no such thing as "username" in SAML, you have to encode it into some</span></i></div><div><i><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13.333333969116211px; background-color: rgb(255, 255, 255); ">Attribute, such as eduPersonPrincipalName, or as a SAML NameID in some</span></i></div><div><i><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13.333333969116211px; background-color: rgb(255, 255, 255); ">custom format.</span></i></div></blockquote><div><br></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;">This I do in the IdP in attribute-resolver.xml and use </span></font><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13px; ">eduPersonPrincipalName</span><span style="font-size: 13px; color: rgb(34, 34, 34); font-family: arial, sans-serif; ">. The config at the moment shows:</span></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><div> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonPrincipalName" scope="<a href="http://scopehere.com">scopehere.com</a>" sourceAttributeID="uid"></div><div> <resolver:Dependency ref="myLDAP" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" /></div><div> </resolver:AttributeDefinition></div></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><b>Is there a way I can set this to the value the user typed into the username field (which I believe SAML calls principal?) without having to of to an external LDAP/DB to retrieve?</b></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;">2) </span></font><i>Then you need to release the relevant attribute ID within the IdP to the</i></div><i>SP.</i><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;">This I do in attribute-filter.xml I believe: ( I know this will release to all SPs but this will do for now)</span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><div><span style="font-size: 13px;"> <!-- Release the transient ID to anyone --></span></div><div><span style="font-size: 13px;"> <afp:AttributeFilterPolicy id="releaseeduPersonPrincipalNameToAnyone"></span></div><div><span style="font-size: 13px;"> <afp:PolicyRequirementRule xsi:type="basic:ANY"/></span></div><div><span style="font-size: 13px;"> <afp:AttributeRule attributeID="eduPersonPrincipalName"></span></div><div><span style="font-size: 13px;"> <afp:PermitValueRule xsi:type="basic:ANY"/></span></div><div><span style="font-size: 13px;"> </afp:AttributeRule></span></div><div style="font-size: 13px; "><br></div><div style="font-size: 13px; ">The on the IDP I have to do nothing as it will map eduPersonPrincipalName to REMOTE_USER?</div><div style="font-size: 13px; "><br></div></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;">Does that look right?</span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;">JF</span></font></div><div><font color="#222222" face="arial, sans-serif"><span style="font-size: 13px;"><br></span></font><div><div>On 15 May 2013, at 19:59, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">And I should have noted, if you just use eduPersonPrincipalName, then</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">there's nothing to do on the SP side, that's all done by default.</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">But nothing can define EPPN for you, you have to generate it as</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">appropriate, be it directly from the username and adding the scope, or</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">pulling it from LDAP, or whatnot.</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">-- Scott</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "></blockquote></div><br></div></body></html>