...
Indicated by type="XML"
, implements an XML-based rule syntax for designating SAML attributes and name identifiers to decode into internal attributes. The plugin supports extraction of SAML attributes and name identifiers from the following SAML constructs (it does not know how to pull any other data from these elements, only attributes and name identifiers):
<saml:Assertion>
<saml:Attribute>
<saml:NameIdentifier>
<saml2:Assertion>
<saml2:Attribute>
<saml2:NameID>
<saml2:EncryptedAttribute>
...
Each <am:Attribute>
element installs a rule for extracting a named SAML attribute or name identifier into an internal attribute. The source of the attribute is identified with the name
(and possibly nameFormat
) XML attributes and internally tagged with the id
(and possibly aliases
) XML attributes. The aliases
feature is deprecated and may be removed from a future release, consider revising to use the Transform AttributeResolver.
The name
property corresponds to the Name
XML attribute of a SAML <Attribute>
element or the Format
XML attribute of a SAML <NameID>
/<NameIdentifier>
element.
The Shibboleth SP by default will install rules using a nameFormat
of urn:mace:shibboleth:1.0:attributeNamespace:uri
and urn:oasis:names:tc:SAML:2.0:attrname-format:uri
to accomodate all SAML versions. The nameFormat
property can be omitted unless a non-standard non-URI-based different NameFormat
is being used. The This property is also omitted/ignored when extracting information from a <NameID>
/<NameIdentifier>
element.
...
Indicated by type="Assertion"
, allows well-defined content from within a SAML assertion to be extracted and passed to an application as an attribute. This supplements older support for extracting a fixed set of information from the assertion and populating well-defined variables/headers (e.g., the Shib-Identity-Provider header and so forth).
Code Block | ||||||
---|---|---|---|---|---|---|
| ||||||
<AttributeExtractor type="Assertion" Issuer="Shib-Identity-Provider" AuthnInstant="Shib-Authentication-Instant" AuthnContextClassRef="Shib-AuthnContext-Class" AuthnContextDeclRef="Shib-AuthnContext-Decl" SessionIndex="Shib-Session-Index" /> |
...