<div dir="ltr">Hello,<div><br></div><div>I am working with an outside vendor on setting up a hosted SP to talk to our IdP. After much wrangling, we have it working. I'm releasing email address as the source attribute for a NameID, encoded as SAML2StringNameID, type of emailAddress. </div>
<div><br></div><div>The problem is, some of the people who use this service don't get email accounts from us--only LDAP accounts. (It used to be authenticated with LDAP.) I am loathe to put their non-Smith email addresses in the "mail" attribute of these accounts, since those addresses are outside our domain.</div>
<div><br></div><div>Since this service is only using the email address as a unique identifier, I thought of using eppn as the nameID -- but I understand now that scoped attributes don't exist in their final @SCOPE format within the attribute-resolver. </div>
<div><br></div><div>So I am thinking of creating a resolver template attribute definition. I believe I understand how to do that piece, but I'm wondering about then using the resulting attribute for a NameID release. If it's possible to do this, then I have a few questions:</div>
<div><br></div><div>1. The sourceAttributeID for the nameID definition would be the ID listed in the attribute definition template, yes? (bold and red in example below):<br></div><div><div><br></div><div><font face="courier new, monospace"><resolver:AttributeDefinition xsi:type="Template" xmlns="urn:mace:shibboleth:2.0:resolver:ad"</font></div>
<div><font face="courier new, monospace"> id="<font color="#ff0000"><b>UNIQUE_ID</b></font>"></font></div></div><div><br></div><div>...and the attribute definition template would have to precede the nameID section...? (or no?)</div>
<div><br></div><div>3. Can I leave my nameid-format at this:</div>
<div><br></div><div><div><font face="courier new, monospace"> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"</font></div>
</div><div><br></div><div>since the end product will be in the general format of an email address? or should I use </div><div><br></div><div><font face="courier new, monospace">nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" <br>
</font></div><div><br></div><div>(which is what our Gmail definition uses)? I would tend to think "unspecified" would be the one to use, since I'm basically making this attribute up. </div><div><br></div><div>
4. The SP has "emailAddress" as the nameid format in their metadata as well, so I assume whatever I use (emailAddress or unspecified), they would use, yes?<br></div><div><br></div><div>5. Would they put my nameID attribute as the FriendlyName of the attribute in this section:</div>
<div><br></div><div><div><font face="courier new, monospace"><md:RequestedAttribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"/></font></div>
</div><div><br></div><div>or the attribute definition template one (red and bold, in the example above)? Since they aren't using my current NameID attribute ("mailasNameID"), I'm unclear on this.</div><div>
<br></div><div>---</div><div>Or...instead of having two separate chunks, could I create some monstrously complicated AttributeDefinition block that would do all of this in one fell swoop?</div><div><br></div><div>Sorry to have so many questions... I really appreciate your help.<br>
</div><div><div><br></div><div>Thanks!</div><div>Karla B</div><div><br></div>-- <br><div style="margin-left:40px">Karla Borecky<br>Systems Administrator<br>
ITS<br>Smith College<br>Northampton, MA 01063<br></div>
</div></div>