<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">There’s probably a much better way and I’m not a fan of creating lots of custom attributes to manage, but in attribute-resolver.xml, maybe create a custom attribute
for the “special” SP? If you have an attribute you use by default for most things, keep it. For Google, create a custom attribute that looks exactly like the other attribute, but set the regex transform for new/custom attribute the way you want. Then in
attribute-filter.xml release the new custom attribute to Google instead of the old one.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Steven Teixeira<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Dylan Martin<br>
<b>Sent:</b> Thursday, December 1, 2016 12:52 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> SP specific password transforms?<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi all.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have an IDPv3 and I need to perform different password transforms for two different SPs. Is there a way to say to use one transform for one SP and a different transform for a different SP?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Is there a generic or idiomatic way to make setting only apply to particular SPs in shibboleth? I imagine it comes up a lot. The PolicyRequirementRule in the attribute filter is the closest thing I've seen, but I doubt that would work
in password-authn-config.xml. Or maybe I'm thinking about it wrong. Maybe you add the transform the relaying party config?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Here's the whole situation, if you haven't already fallen asleep or answered my question:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We're a campus within a district. The district recently set up a district-wide AD server, and I'm using that as the LDAP back-end for my shib system. Our Google apps domain is different from the district domain, but I've set up provisioning
so the Google accounts have the same username part of the user's email address. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">EG a google account might look like <a href="mailto:alice.smith@campus.edu">
alice.smith@campus.edu</a> and the district account might look like <a href="mailto:alice.smith@district.edu">
alice.smith@district.edu</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Because our Google domain is our own campus thing, it expects logins like
<a href="mailto:alice.smith@campus.edu">alice.smith@campus.edu</a>. The other SP we use is set up expects logins like
<a href="mailto:alice.smith@district.edu">alice.smith@district.edu</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I set up a regex transform so users could enter just the username or the username and domain for the SP I've allready got working. Obviously, this same transform will not work with google.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Sorry to keep going, but I have a habit of not making sense, so I'm trying to be thorough. Please ignore if you like.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">User enters username "alice.smith"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Google expects "<a href="mailto:alice.smith@campus.edu">alice.smith@campus.edu</a>"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Other SP expects "<a href="mailto:alice.smith@district.edu">alice.smith@district.edu</a>"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hopefully that makes sense. Sorry if this is documented somewhere and I missed it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Dylan<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>