将Shibboleth(v3)用作SP时，我可以映射attribute-map.xml中的属性值吗? [英] When using Shibboleth (v3) as SP , can I map the attribute value in attribute-map.xml?

问题描述

在此设置中，OKTA是IdP，Shibboleth是SP. OKTA正在传递属性角色"，例如idp_dev_SLAN_Power，idp_dev_SLAN_Admin，idp_dev_SLAN_account等

OKTA is IdP and Shibboleth is SP in this setting. OKTA is passing attribute 'roles' something like idp_dev_SLAN_Power, idp_dev_SLAN_Admin, idp_dev_SLAN_account, etc

我想知道是否可以在使用'idp_dev_SLAN_'这个属性时将其删除.

I am wondering if I can strip 'idp_dev_SLAN_' out when it takes this attribute.

这是我在当前attribute-map.xml中看到的内容.

Here is what I see in the current attribute-map.xml.

<Attribute id="roles" name="roles" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" />

我觉得我可以使用AttributeDecoder做一些事情.有什么想法吗?

I feel like I can possibly do something with AttributeDecoder. any idea??

推荐答案

我认为您可能正在寻找AttributeResolver的Transform类型，其中:

I think you are probably looking for the Transform type of AttributeResolver which:

将一个或多个正则表达式应用于输入属性，以替换其值或生成新属性. -来自 Shibboleth Wiki

举一个例子:

<AttributeResolver type="Transform" source="displayName">
    <Regex match="^(.+) (.+)$" dest="givenName">$1</Regex>
    <Regex match="^(.+) (.+)$" dest="sn">$2</Regex>
    <Regex match="^(.+) (.+)$">$2, $1</Regex>
</AttributeResolver>

将displayName转换为两个属性givenName和sn.但是我敢肯定，您可以构建一个正则表达式来获取各种入站元素的idp_dev_SLAN_并将其映射到您想要的一个或多个属性.

which transforms a displayName into two attributes givenName and sn. But I'm certain you could build a regular expression to grab idp_dev_SLAN_ for the various inbound elements and map those to 1 or more attributes of your desire.

这篇关于将Shibboleth(v3)用作SP时，我可以映射attribute-map.xml中的属性值吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！