<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Le 16/10/2013 19:48, Kevin P. Foote a
écrit :<br>
</div>
<blockquote cite="mid:alpine.LFD.2.03.1310161330120.14584@iup.edu"
type="cite">
<pre wrap="">
On Wed, 16 Oct 2013, Jehan Procaccia wrote:
</pre>
<blockquote type="cite">
<pre wrap=""><resolver:AttributeDefinition id="email" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="mail">
<resolver:Dependency ref="ldapTMSP" />
<resolver:AttributeEncoder xsi:type="SAML1String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:mace:dir:attribute-def:mail" />
<resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
</resolver:AttributeDefinition>
So if I understood well, that attribute name is "email" (not mail right !?)
it's nameFormat is either SAML1String or SAML2String
and it's not a NameID .
If I want it to become a NameID it must be of type
xsi:type="SAML2StringNameID" , but is it possible to sent multiple
NameID attributes, my IDP already sends
AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"
</pre>
</blockquote>
<pre wrap="">
Of the available attributes that are encoded to the proper NameID Format
during the resolution and release phase, the Shib IdP will only pick one
to send as the NameID of the assertion.
Stated differently you can attach NameID encoders to multiple attribute
definitions during the resolver stage. During the filtering and release
stage a single NameID value will be chosen from the pool of available
attributes that can be released to a given RP.
You can force which one is chosen by limiting the available attributes
at release or using the precedence capabilities (see Selection Process
linked below).
<a class="moz-txt-link-rfc2396E" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier"><https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier></a>
------
thanks
kevin.foote
--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre>
</blockquote>
following your recommendations, I created a custom NameID for that
vendor, <br>
but I still cannot figure out how to use a "precedence capability"
to ensure that for that vendor, it is that custom NameID that is
released<br>
below in bold are my IDP released 4 attributes<br>
<br>
22:09:39.847 - INFO [Shibboleth-Audit:745] -
20131017T200939Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||<a class="moz-txt-link-freetext" href="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp">https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp</a>|urn:mace:shibboleth:2.0:profiles:saml1:sso|<a class="moz-txt-link-freetext" href="https://idp.int-evry.fr/idp/shibboleth">https://idp.int-evry.fr/idp/shibboleth</a>|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_207ae3af9497eb3b439b2a5ba82ed018|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|<b>supannEtablissement,transientId,email,travelId,</b>|_8ac27ab82e7a98e91805eb952eb2657e|_0d67aca402980281b44bfc8fabd792ee,|<br>
<br>
according to my attribute-resolver custom NameID<br>
<br>
<!-- nameID for travel ID--><br>
<resolver:AttributeDefinition id="<b>travelId</b>"
xsi:type="Simple" sourceAttributeID="mail"<br>
xmlns="urn:mace:shibboleth:2.0:resolver:ad">
<resolver:Dependency ref="ldapTMSP" /> <br>
<resolver:AttributeEncoder
xsi:type="SAML1StringNameIdentifier"<br>
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/> <br>
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"<br>
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/><br>
</resolver:AttributeDefinition><br>
<br>
my attribute-filter<br>
<br>
<AttributeFilterPolicy id="releaseTransientIdToAnyone"><br>
<PolicyRequirementRule xsi:type="basic:ANY" /><br>
<AttributeRule attributeID="transientId">
<PermitValueRule xsi:type="basic:ANY"
/></AttributeRule> <br>
<AttributeRule attributeID="supannEtablissement">
<PermitValueRule xsi:type="basic:ANY"
/></AttributeRule> <br>
<AttributeRule attributeID="mail"> <PermitValueRule
xsi:type="basic:ANY" /></AttributeRule><br>
<AttributeRule
attributeID="travelId"><PermitValueRule xsi:type="basic:ANY"
/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
How can I make that travelID be THE nameID dir that SP , while still
keep transientId for other SPs ? <br>
<br>
Thanks .<br>
</body>
</html>