Shibboleth Developers

["Scott Cantor" <>]

> > I think the shib distribution defaults to mapping EPPN to
> > REMOTE_USER. For instance, that's how the Shib Wiki works....
> 
> I'd be surprised if this were in fact true (it would blow my
> understanding of name mappings out of the water :). 

You two are discussing opposite ends. The Shib *SP* maps EPPN to
REMOTE_USER, and a Shib OSID would be an SP thing, not an IdP thing.

> If REMOTE_USER is of the form 
> "user@domain"
>  initially (and I can see
> why you might want this), a bunch of stuff on the back end has to
> change.  Additionally, if you're using emailAddress or kerberos name
> identifiers (not common today, I know), the name mapping process
> itself becomes somewhat complicated.  This probably argues for opaque
> identifiers more than anything else.

Yeah, probably so. But regardless, the IdP doesn't really make any
assumptions about REMOTE_USER at all because the default Name formats are
opaque. The assumptions bridge between REMOTE_USER on the front, and
resolver.xml on the back end.

-- Scott