<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 7/13/16 3:47 PM, Michael Weyandt
wrote:<br>
</div>
<blockquote
cite="mid:BA265BA2-AFAF-432C-97B3-A048630CA5F8@zips.uakron.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div class="">
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class="">In my attribute-resolver.xml I have the
following..</div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class=""><br class="">
</div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class=""> <resolver:AttributeDefinition
id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"></div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class=""> <resolver:Dependency ref=“ldap-auth"
/></div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class=""> <resolver:AttributeEncoder
xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class="">
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
/></div>
<div style="margin: 0px; line-height: normal; color: rgb(69, 69,
69);" class=""> </resolver:AttributeDefinition></div>
</div>
<div class=""><br class="">
</div>
<div class="">Basically just trying to understand what they were
doing with this.</div>
<div class=""><br class="">
</div>
<div class="">To me it looks like a Principal Name Attribute mixed
with a custom name identifier?</div>
<br>
</blockquote>
<br>
Yes, that's basically it. It's going to encode the user's principal
name as a SAML 2 NameID, with the NameID having that unspecified
format URI. <br>
<br>
The principal name is an internal value managed within the IdP,
which is usually the identifier they used when they authenticated.
It's usually going to be the username the user used when logging in,
although it can technically be more complicated than that if you are
doing something more esoteric with authN. [1].<br>
<br>
Btw, that ldap-auth dependency is not used and could be removed,
since the PrincipalName attribute def doesn't evaluate it.<br>
<br>
[1]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverPrincipalNameDefinition">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverPrincipalNameDefinition</a><br>
</body>
</html>