...
Indicated by type="XML"
, implements an XML-based rule syntax for designating SAML attributes and name identifiers to decode into internal attributes. The plugin supports extraction of SAML attributes and name identifiers from the following SAML constructs (it does not know how to pull any other data from these elements, only attributes and name identifiers):
<saml:Assertion>
<saml:Attribute>
<saml:NameIdentifier>
<saml2:Assertion>
<saml2:Attribute>
<saml2:NameID>
<saml2:EncryptedAttribute>
...
The Shibboleth SP by default will install rules using a nameFormat
of urn:mace:shibboleth:1.0:attributeNamespace:uri
and urn:oasis:names:tc:SAML:2.0:attrname-format:uri
to accomodate all SAML versions. The nameFormat
property can be omitted unless a non-standard non-URI-based different NameFormat
is being used. The This property is also omitted/ignored when extracting information from a <NameID>
/<NameIdentifier>
element.
...
Indicated by type="Assertion"
, allows well-defined content from within a SAML assertion to be extracted and passed to an application as an attribute. This supplements older support for extracting a fixed set of information from the assertion and populating well-defined variables/headers (e.g., the Shib-Identity-Provider header and so forth).
Code Block | ||||||
---|---|---|---|---|---|---|
| ||||||
<AttributeExtractor type="Assertion" Issuer="Shib-Identity-Provider" AuthnInstant="Shib-Authentication-Instant" AuthnContextClassRef="Shib-AuthnContext-Class" AuthnContextDeclRef="Shib-AuthnContext-Decl" SessionIndex="Shib-Session-Index" /> |
...