<div dir="ltr"><div class="gmail_extra"><span style="font-size:12.8px">> That configuration file is for RemoteUserInternal, not RemoteUser.</span><br style="font-size:12.8px"></div><div class="gmail_extra"><span style="font-size:12.8px"><br></span></div><div class="gmail_extra"><span style="font-size:12.8px">Done, thanks! We now have the subject. Which for uninteresting reasons is scoped, and we need the unscoped username for attribute resolution purposes.</span></div><div class="gmail_extra"><span style="font-size:12.8px"><br></span></div><div class="gmail_extra"><span style="font-size:12.8px">Now how can we strip the domain, returning just username? I.e., for RemoteUser, where would I stick this? In IDP 2.x, you could define principal as an attribute and hack at it there, but does that still valid in 3.0?</span></div><div class="gmail_extra"><span style="font-size:12.8px"><br></span></div><div class="gmail_extra"><span style="font-size:12.8px"><div class="gmail_extra">    <util:list id="shibboleth.authn.RemoteUser.Transforms"></div><div class="gmail_extra">        <!--</div><div class="gmail_extra">        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" /></div><div class="gmail_extra">        --></div><div class="gmail_extra">    </util:list></div><div><br></div></span></div><div class="gmail_extra"><span style="font-size:12.8px"><br></span></div><div class="gmail_extra"><span style="font-size:12.8px"><br></span></div></div>