Requesting and Changing Attributes
On this page you will find information on how to request attributes and customize them with your Shibboleth ServiceProvider module for the applications to be protected.
- Joining an entity category with the ServiceProvider
- Requesting attributes via the ServiceProvider metadata
- Requesting pairwise-id
- Changing attributes
Joining an entity category with the ServiceProvider
For a local ServiceProvider to be able to consume the standard released attributes from IDM.nrw (opens in new tab), it must belong to the Entity Category https://sso.rwth-aachen.de/category/rwth.
For this purpose, the following must be entered in the metadata of the ServiceProvider in the <Extensions> area:
<md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"><!-- ... --> <mdattr:EntityAttributes> <saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue>https://sso.rwth-aachen.de/category/rwth</saml:AttributeValue> </saml:Attribute> </mdattr:EntityAttributes></md:Extensions> |
Requesting attributes via the ServiceProvider metadata
If the ServiceProvider now wants to use one of the attributes recommended by IDM.nrw (opens in new tab) for general release, its configuration in the <SPSSODescriptor></<SPSSODescriptor> must include the following:
|
If the ServiceProvider requires the pairwise-id, the metadata extensions must be adapted:
|
If you want to change an attribute on the ServiceProvider side to meet your own needs, you can use "TransformAttributeResolve (opens in new tab)r" for this purpose.
The "Transform" uses the Shared Library plugins.so (opens in new tab). For this reason, an additional entry should be made in /etc/shibboleth/shibboleth2.xml:
<OutOfProcess logger="shibd.logger"> <Extensions> <Library path="plugins.so"/> </Extensions> </OutOfProcess> |
Example: Dividing displayName into the first and last name
For this purpose, a correspondent resolver is to be configured in /etc/shibboleth/shibboleth2.xml:
<AttributeResolver type="Transform" source="displayName"> <Regex match="^(.+) (.+)$" dest="givenName">$1</Regex> <Regex match="^(.+) (.+)$" dest="sn">$2</Regex> <Regex match="^(.+) (.+)$">$2, $1</Regex> </AttributeResolver> |
Here, the attribute "displayName" is divided into two addinional attributes, namely "givenName" and "sn", on the one hand, and on the other hand, the display name is assigned the format "last name, firstname". For this purpose, a Regex is defined (here: two Redx groups) and the matches are extracted correspondently.
Example: extracting eduPersonTargetedID
Another example is the attribute "eduPersonTargetedID":
<AttributeResolver type="Transform" source="persistent-id> <Regex match="^https://login.rz.rwth-aachen.de/shibboleth\!https://mein.sp/shibboleth\!(.+)$" dest="uniqueID">$1</Regex> </AttributeResolver> |
OR
<AttributeResolver type="Transform" source="persistent-id"> <Regex match="^(.+)!(.+)!(.+)$" dest="uniqueID">$3</Regex> </AttributeResolver> |
In both examples, the 64 symbol string is extracted out of eduPersonTargetedID and is written into the field "uniqueID".
In the latter example:
- $1 of IdP, who provides eduPersonTargetedID
- $2 of SP, who consumes eduPersonTargetedID
- $3 the 64 symbol long, per SP defined, ID
Example: Removing a part of a string (here orgID out of eduPersonEntitlements such as a role string)
If you want to remove a part of the string because the application cannot handle it, you can transform the attribute as follows:
<AttributeResolver type="Transform" source="eduPersonEntitlement"> <Regex match="^(.+):(orgid=.+)$" dest="entitlement">$1</Regex> </AttributeResolver> |
In this case in $1, the old entitlement is saved in "entitlement". In $2, the orgID is available.
