Overview

Identified by type="Assertion", this AttributeExtractor allows well-defined content from within a SAML Assertion to be extracted and passed to an application as an attribute. This supplements the support for extracting a fixed set of information from the assertion and populating well-defined variables/headers (e.g., the Shib-Identity-Provider header and so forth).

Reference

Attributes

The following XML attributes are supported by this type:

NameTypeDescription
ConsentstringNames the SP attribute to carry the value of the Consent attribute found in the response that delivered the assertion
AuthenticatingAuthoritystringNames the SP attribute to carry the value(s) of the <AuthenticatingAuthority> element(s) found in the assertion
AuthnContextClassRefstring

Names the SP attribute to carry the value of the <AuthnContextClassRef> element or AuthenticationMethod attribute found in the assertion. Equivalent to the built-in Shib-AuthnContext-Class and Shib-Authentication-Method variables.

AuthnContextDeclRefstringNames the SP attribute to carry the value of the <AuthnContextDeclRef> element found in the assertion. Equivalent to the built-in Shib-AuthnContext-Decl variable.
AuthnInstantstringNames the SP attribute to carry the value of the AuthnInstant attribute found in the assertion. Equivalent to the built-in Shib-Authentication-Instant variable
IssuerstringNames the SP attribute to carry the value of the <Issuer> element found in the assertion. Equivalent to the built-in Shib-Identity-Provider variable.
NotOnOrAfterstringNames the SP attribute to carry the value of the NotOnOrAfter attribute found in the assertion
SessionIndexstringNames the SP attribute to carry the value of the SessionIndex attribute found in the assertion. Equivalent to the built-in Shib-Session-Index variable.
SessionNotOnOrAfterstringNames the SP attribute to carry the value of the SessionNotOnOrAfter attribute found in the assertion
AddressstringNames the SP attribute to carry the value of the Address attribute found in the assertion's <SubjectLocality> element
DNSNamestringNames the SP attribute to carry the value of the DNSName attribute found in the assertion's <SubjectLocality> element

Example

<AttributeExtractor type="Assertion"
    Issuer="Shib-Identity-Provider"
    AuthnInstant="Shib-Authentication-Instant"
    AuthnContextClassRef="Shib-AuthnContext-Class"
    AuthnContextDeclRef="Shib-AuthnContext-Decl"
    SessionIndex="Shib-Session-Index"
/>