<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Peter,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks very much for the prompt reply.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I did attempt to do that with the output of aacli being</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"name": "mailFromSAMAccountName",
<div> "values": [</div>
<div> "ScopedStringAttributeValue{value=nmp1u14, scope=soton.ac.uk}"</div>
]</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
however the sp could not pick up the scope for some reason. So I resorted to using a script</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<!-- UoS: mailFromSAMAccountName: value is scoped so <sAMAccountName>@soton.ac.uk -->
<div> <AttributeDefinition id="mailFromSAMAccountName" xsi:type="ScriptedAttribute" relyingParties="https://sp.idoxgroup.com/shibboleth"></div>
<div> <!-- We need LDAP for this attributes value --></div>
<div> <InputDataConnector ref="uos_ldap" attributeNames="sAMAccountName" /></div>
<div> <!-- How to encode the attribute in SAML --></div>
<div> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /></div>
<div> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /></div>
<div><br>
</div>
<div> <!-- The script --></div>
<div> <Script><![CDATA[</div>
<div> mailFromSAMAccountName.addValue(sAMAccountName.getValues().get(0) + "@%{idp.scope}");</div>
<div> ]]></Script></div>
<span> </AttributeDefinition></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
which resulted in <br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"name": "mailFromSAMAccountName",
<div> "values": [</div>
<div> "StringAttributeValue{value=nmp1u14@soton.ac.uk}"</div>
<span> ]</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Not sure if this is the "best" way but it works.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Thanks<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Nilan</span><br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> 14 June 2021 17:06<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Re: Releasing mail as scoped sAMAccoutName for a specific SP</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This e-mail originated outside the University of Southampton.<br>
<br>
* Nilan Morjaria-Patel <N.Morjaria-Patel@soton.ac.uk> [2021-06-14 17:44]:<br>
> I require help regarding the above. I have the following script in<br>
> attribute-resolver.xml where the SP's only requirement is<br>
> mail. However our users can change their mail prefix so we want to<br>
> release the scoped sAMAccoutName instead.<br>
<br>
You'd use a Scoped attribute definition that slaps on %{idp.scope} to<br>
your sAMAccoutName attribute.<br>
Then an Encoder to send it as mail attribute with a relyingParties<br>
XML-attribute enumerating the SPs that require this hack.<br>
<br>
No scripting necessary and likely will fix your issue of duplicate<br>
values, too.<br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cb127ab8f3cf34438fb2808d92f4e6a45%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637592836108780555%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=odjq3J60iFRTmULIUZqsOotVOMI%2FImFEYSC8KBtt1Fg%3D&reserved=0">
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cb127ab8f3cf34438fb2808d92f4e6a45%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637592836108780555%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=odjq3J60iFRTmULIUZqsOotVOMI%2FImFEYSC8KBtt1Fg%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>