<div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">
>I'd expect those attributes to come through as Meta-eppn, Meta-mail, and Meta-uid.<br>
<br>
</span>Not unless you're excepting those attributes to be inside the IdP's metadata as EntityAttribute extensions, which doesn't really make a lot of sense, so I don't think you are.<br>
<br>
You're confusing this with attributePrefix (I think that's what I called it). That's a different setting.<span class=""><font color="#888888"><br></font></span></blockquote><div><br></div><div>My confusion comes from <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication</a>:<br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><ul><li><code>metadataAttributePrefix</code>(string)<ul><li>If set,
attributes extracted from metadata have their IDs and aliases prefixed
with this value. Allows applications to distinguish between attributes
about the user and attributes about the user's identity provider.</li></ul></li></ul></blockquote>And <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-MetadataAttributeExtraction%28Version2.2andAbove%29">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-MetadataAttributeExtraction%28Version2.2andAbove%29</a>:<br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">To ensure they can be distinguished from more typical user data, the trigger for this feature is the <code>metadataAttributePrefix</code> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication">application</a>
property. Setting this property is both a precondition for metadata
attribute extraction and a value that is prepended to the internal
attribute names that result. For example, a prefix of "Meta-" will turn
an extracted attribute called "mail" into "Meta-mail".<br></blockquote><br></div><div>I'm probably completely failing to recognise the importance of "internal" in "internal attribute names", but those links seem to suggest that an application (which I thought of in this context as libapache2-mod-php5) should be able to pick up principal attributes by looking for "Meta-".<br><br></div><div>However, it looks like I can use attributePrefix instead, look for that prefix in environment variables, exclude things starting with 'Shib-', and be left with a map of released attributes. It just feels a little convoluted, which makes me think I'm missing something (more than likely given it's approaching 1:00AM)<br><br></div><div>Phil<br></div></div></div></div>