<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>Greetings,</div>
<div><br>
</div>
<div>I'm trying to federate my shibV3 IdP with an SP. They require eduPersonScopedAffiliation attribute which the IdP is passing:</div>
<div><br>
</div>
<div> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"</div>
<div> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div> ></div>
<div> <saml2:AttributeValue><a href="mailto:students@mydomain.ca">students@mydomain.ca</a></saml2:AttributeValue></div>
<div> </saml2:Attribute></div>
<div><br>
</div>
<div>The problem is that "<b>students</b>" is not valid, they only accept "<b>student</b>". So I changed the attribute resolver from this:</div>
<div><br>
</div>
<div style="margin-left: 3ch;">
<div> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation" scope="%{idp.scope}" sourceAttributeID="myAttribute"></div>
<div> <resolver:Dependency ref="ldap" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" encodeType="false" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" encodeType="false" /></div>
<div> </resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div>To this:</div>
<div><br>
</div>
<div style="margin-left: 3ch;">
<div> <resolver:AttributeDefinition xsi:type="ad:Mapped" id="eduPersonScopedAffiliation" sourceAttributeID="myAttribute"></div>
<div> <resolver:Dependency ref="ldap" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" encodeType="false" /></div>
<div> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" encodeType="false" /></div>
<div> <ad:ValueMap></div>
<div> <ad:ReturnValue><a href="mailto:student@mydomain.ca">student@mydomain.ca</a></ad:ReturnValue></div>
<div> <ad:SourceValue>students</ad:SourceValue></div>
<div> </ad:ValueMap></div>
<div> </resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div><b>Is this mapped definition functionally equivalent to the scoped definition? </b></div>
<div><br>
</div>
<div>I can see the mapped attribute when testing from the IdP with this command "aacli.sh --configDir /opt/shibboleth-idp/conf --principal=someUser --requester
<a href="https://sp.somedomain.ca"">https://sp.somedomain.ca"</a>. However, I cannot see the mapped attribute in the SAML assertion to the SP when inspecting with the SAML tracer tool for firefox.</div>
<div><br>
</div>
<div><b>Why is the mapped attribute not part of the assertion if it shows up with aacli?</b></div>
<div><br>
</div>
<div>regards,</div>
<div>Ryan</div>
</body>
</html>