The c14n/SAML2ProxyTransform post-login subject c14n flow does an extraction of a NameIDPrincipal from the Java Subject and returns the value as the canonical principal name for the subject. It also supports a small set of optional transforms (and as of V4.1+ case folding) to apply to the name.
The primary use case for this feature is the SAML login flow, i.e., SAML proxying. It allows a simple import of the asserted <saml2:NameID> element value from the proxied IdP as the normalized subject name. This is essentially the same functionality as the non-proxy variant of this feature described under the NameIDConsumptionConfiguration topic, but is separate so that the control beans of the two features (the ones discussed below) don't need to overlap.
Use conf/c14n/subject-c14n.xml (and in V4.1+ possibly conf/c14n/subject.properties) to configure this flow.
The most important bean is shibboleth.ProxyNameTransformPredicate, which controls the circumstances under which the importing flow will be allowed to run. The bean itself must be a Predicate object. The example configuration demonstrates how to create a condition that requires the issuer be one of a listed set of named entities. But any Predicate can be used, such as a script. With some proxies, it's assumed that control over the metadata and allowable authenticating IdPs is sufficient to allow broad acceptance of whatever NameID value they happen to supply.
The shibboleth.ProxyNameTransformFormats bean is a list of the NameID Format(s) that you want to support. The pre-existing list contains a number of Formats defined by SAML. You may need to add to it if you or some other party needs to exchange a custom Format.
The flow supports some simple transform capability. The shibboleth.ProxyNameTransforms bean is a list of regular expression and replacement string pairs that can transform the input value into a different username value rather than importing it directly. V4.1+ also allows for case folding via a couple of properties.
In the most unusual cases, V4.1 + adds support for injecting a custom object of your own creation that implements the NameIDDecoder interface to fully customize the decoding process. The bean name shibboleth.SAML2ProxyTransform.NameIDDecoder is reserved for this purpose.
Properties related to this feature in conf/c14n/subject-c14n.properties follow:
Whether to lowercase the incoming NameID value prior to applying any transforms
Whether to upcase the incoming NameID value prior to applying any transforms
The beans related to this feature in conf/c14n/subject-c14n.xml follow: