Shibboleth Developers

[Scott Cantor <>]

cc'ing shib-design

> Make sense now.. I added the support for "requires 
> affiliation" and was able to test it by adding the "requires 
> affiliation" line in httpd.conf before "requires group shib"
> 
> I left it commented out in httpd.conf file in case you make to verify.

Thanks. If it's all working tomorrow, I think that should do it.

What I envision for the beta RM is a command to create mappings from an
attribute URI to a header name and a require alias:

Eg.

ShibAttributeMapping \
        urn:mace:eduPerson:1.0:eduPersonPrincipalName REMOTE_USER user
ShibAttributeMapping \
        urn:mace:eduPerson:1.0:eduPersonAffiliation SHIB_EP_AFFILIATION
\
        affiliation

(a Take3 command type that gets three string parameters)

That would tell the RM to behave like the alpha module does, basically.
This seems like the proper balance between flexibility and simplicity to
me, and it's not difficult to build. It only really addresses
"flattened" attribute expressions, but that's about all we understand at
this point anyway.

-- Scott

------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--