<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Peter,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the prompt and detailed reply. I was only given the task late last week and the deadline was yesterday and so as my fudge seems to work I stuck with it. I certainly like the idea of "<font size="2"><span style="font-size:11pt">in a simpler to use/understand/maintain
way</span></font>" that you suggested, so I will look at testing that in dev and if I still get the same result then push that to production.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Nilan<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> 15 June 2021 15:56<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Re: Releasing mail as scoped sAMAccoutName for a specific SP</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This e-mail originated outside the University of Southampton.<br>
<br>
* Nilan Morjaria-Patel <N.Morjaria-Patel@soton.ac.uk> [2021-06-15 16:18]:<br>
> I did attempt to do that with the output of aacli being<br>
><br>
> "name": "mailFromSAMAccountName",<br>
> "values": [<br>
> "ScopedStringAttributeValue{value=nmp1u14, scope=soton.ac.uk}"<br>
> ]<br>
><br>
> however the sp could not pick up the scope for some reason.<br>
<br>
That's not quite what I suggested (I literally meant not defining an<br>
attribute only for this weird combo) but looks OK, I think.<br>
(It's much more obvious if you supply the --saml2 parameter to your<br>
aacli command invocation as that'll give you the actual SAML.)<br>
<br>
> So I resorted to using a script<br>
<br>
I meant something like this, assuming below you're populating the<br>
eduPersonPrincipalName attribute from sAMAccoutName + @ + scope and<br>
that you already have a Simple attribute for sAMAccoutName defined.<br>
<br>
I.e., the (assumed) deviation is only in adding one extra Encoder that<br>
names this attribute differently (mail) for the referenced SP only:<br>
<br>
<AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}"><br>
<InputAttributeDefinition ref="sAMAccoutName" /><br>
<AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" relyingParties="<a href="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsp.idoxgroup.com%2Fshibboleth&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278820121%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tfAFrCvOx3GEnycxZnfj7DtBbSSlLGv3DetEuHvcNQw%3D&reserved=0">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsp.idoxgroup.com%2Fshibboleth&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278820121%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tfAFrCvOx3GEnycxZnfj7DtBbSSlLGv3DetEuHvcNQw%3D&reserved=0</a>"
/><br>
</AttributeDefinition><br>
<br>
The details differ depending on how your existing config looks like<br>
and how much you've cleaned your resolver from AttributeEncoder<br>
elements (i.e., whether you've updated from v3 or migrated to using<br>
the new-with-v4 attribute registry), etc.<br>
<br>
> <AttributeDefinition id="mailFromSAMAccountName" xsi:type="ScriptedAttribute" relyingParties="<a href="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsp.idoxgroup.com%2Fshibboleth&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278830076%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=imWN3YnJiBN%2FOJZVN2TDB2ttVZ9CSzWERGHqjKA4OuY%3D&reserved=0">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsp.idoxgroup.com%2Fshibboleth&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278830076%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=imWN3YnJiBN%2FOJZVN2TDB2ttVZ9CSzWERGHqjKA4OuY%3D&reserved=0</a>"><br>
<br>
FWIW, I don't think the relyingParties XML-attribute will do anything<br>
useful on the AttributeDefinition XML-element. (It belongs on the<br>
Encoder you want to make specific for those relyingParties, as shown<br>
above and in The Fine Documentation.)<br>
<br>
> Not sure if this is the "best" way but it works.<br>
<br>
I'd be surprised if your two methods produced different output when<br>
using aacli with the --saml2 parameter. (I.e., the wire representation<br>
should be the same, I'd expect) in which case your change is possibly<br>
not what made it work.<br>
<br>
The changes you made from my suggestion are:<br>
<br>
* create a specific attribute when you possibly could have re-used an<br>
existing defintion and simply made the nameing of the attribute<br>
SP-specific<br>
<br>
* used a Script where the appropriate AttributeDefintion should do the<br>
same, in a simpler to use/understand/maintain way<br>
<br>
* releasing your now custom attribute to that SP (instead of ePPN, in<br>
my example), therefore not noticing that the relyingParties<br>
restriction you misplaced didn't actually do anything useful.<br>
<br>
HTH,<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278830076%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=nlo08TqaunK%2FpYjWliRUzqjSgO7CuqecUM72XNVrL%2Fo%3D&reserved=0">
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cn.morjaria-patel%40soton.ac.uk%7Cba4680713f6740b8dcbc08d9300dd49a%7C4a5378f929f44d3ebe89669d03ada9d8%7C0%7C0%7C637593658278830076%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=nlo08TqaunK%2FpYjWliRUzqjSgO7CuqecUM72XNVrL%2Fo%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>