Shibboleth Developers

["Tom Scavo" <>]

On 3/5/06, Tom Scavo 
<>
 wrote:
>
> <NameMapping
>   xmlns="urn:mace:shibboleth:namemapper:1.0"
>   id="x509"
>   format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
>   template="uid=%PRINCIPAL%,o=example.org"
>   regex="uid=([^,/]+)"
>   qualifier="https://idp.example.org/shibboleth";
>   
> class="edu.internet2.middleware.shibboleth..X509SubjectNameNameIdentifierMapping"/>
>
> <NameMapping
>   xmlns="urn:mace:shibboleth:namemapper:1.0"
>   id="email"
>   format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>   
> template="%PRINCIPAL%@example.org"
>   
> regex="([^@]+)@"
>   qualifier="https://idp.example.org/shibboleth";
>   
> class="edu.internet2.middleware.shibboleth..emailAddressNameIdentifierMapping"/>

Actually, this can be simplified even further (which is what I think
you were suggesting earlier):

<NameMapping
 xmlns="urn:mace:shibboleth:namemapper:1.0"
 id="x509"
 format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
 template="uid=%PRINCIPAL%,o=example.org"
 regex="uid=([^,/]+)"
 qualifier="https://idp.example.org/shibboleth";
 type="Principal"/>

<NameMapping
 xmlns="urn:mace:shibboleth:namemapper:1.0"
 id="email"
 format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
 
template="%PRINCIPAL%@example.org"
 
regex="([^@]+)@"
 qualifier="https://idp.example.org/shibboleth";
 type="Principal"/>

and similarly for the WindowsDomainQualifiedName and kerberos
identifiers.  (Cool, one class to implement four SAML name
identifiers.)  This requires mods to NameMapper and/or
PrincipalNameIdentifier.

Tom