<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/22/16 8:39 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE11295FB59@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">I can add the SectorID to my attribute-map but the only
AttributeDecoder that seems to do anything is the XML AttributeDecoder
and it only gives me the child XML elements in base64. I know
Shibboleth can decode EncryptedID's when they're in
ArtifactResponse/Response/Assertion/Subject, this is done in
SAML2Consumer::implementProtocol(). But I can't find an
AttributeDecoder that can do do the same. Is this possible in
Shibboleth 2.5.3?
</pre>
</blockquote>
<pre wrap="">
No, nothing like that is provided. I don't think building a decoder to do that will be that much work, and you have about a day to get a Jira issue in if you want it. But that said, tell them to stop. This is not appropriate. Putting a NameID into an Attribute at all is a lousy idea, but if you want to encrypt it, you don't do it like this. If you need a self-standing encrypted attribute, you use EncryptedAttribute.
</pre>
</blockquote>
<br>
Just noting that he also said this was buried in the Response
Assertion's Advice element:<br>
<br>
ArtifactResponse/Response/Assertion/Advice/Assertion/AttributeStatement/Attribute/AttributeValue/EncryptedID<br>
<br>
<br>
Does the SP even support something like that? Would that still just
be a different decoder impl, or is that completely different logic
to look in the Advice?<br>
</body>
</html>