...
Shibboleth attribute names are case sensitive
| Shibboleth.Attribute | PowerFolder.Field | Purpose | External links |
|---|---|---|---|
Shib-Session-ID | - |  Must be set for authenticating a valid Shibboleth session | |
persistent-id or uniqueID | Account.shibbolethPersistentID | Persistent external ID for retrieving/matching an existing PowerFolder account | |
eduPersonPrincipalName or eppn or EPPN | Account.username | Persistent, external, unique username for retrieving an existing account | |
mail or email | Account.emails |
; (semicolon). Matches existing PowerFolder accounts unless turned off in config: shibboleth.accounts.match_email=false |
scopedUsername or
bwScopedUsername
Persistent, external, unique username for retrieving an existing account
Obsolete. Will be removed in the future
givenName | Account.firstname | Given name of the user | |
surname or sn | Account.surname | Surname of the user | |
o or |
organizationName | Account.organization and Account.custom2 (if unmapped) | Organization (name) of user. Auto-creates organizations within PowerFolder unless turned off in config: shibboleth.create.organizations=falseOrganization attribute name can be alternated by config: shibboleth.organizations.attribute=customOrgAttrib | |
affiliation or eduPersonScopedAffiliation | Account.custom1 |
| Affiliation of user | ||
| (attribute names as in config) | Account.custom2 | Free mapping field. Not mapped by default. Use configuration entry to set mapping |
Available since 10.5| (attribute names as in config) | Account.custom3 | Free mapping field. Not mapped by default. Use configuration entry to set mapping |
Available since 10.5
| (attribute names as in config) | Account.expirationDate | Free mapping field. Not mapped by default. Use configuration entry to set mapping |
Available since 10.5. Format: ISO 8601 or Unix timestamp or yyyyMMddHHmmss |
entitlement or
eduPersonEntitlement
Must match the entitlement value if set in PowerFolder config:
shibboleth.entitlement=http://example.entitlement
(by default no entitlement value is set, which means disabled entitlement check)
The entitlement attribute is optional and should only be set, if it's sent/used by the IdP.
| |||
scopedUsername or bwScopedUsername | Account.username | Persistent, external, unique username for retrieving an existing account
| |
| REMOTE_USER | Account.username |
| Obsolete |
| . Persistent external username for retrieving an account. |
Configuration of Shibboleth-Attribute names
| Info |
|---|
The SAML/Shibboleth-Attribute names can be configured if necessary under Preferences/Shibboleth or in configuration file. |
Example web request with attributes
| Code Block | ||
|---|---|---|
| ||
HTTP_Shib-Identity-Provider: https://idptest.scc.kituniversity.edu/idp/shibboleth HTTP_o: organization REMOTE_USER: zz9999@kitzz9999@university.edu HTTP_entitlement: http://idm.org/entitlement/organization-PowerFolder HTTP_Shib-Session-ID: _01309f0985d68b0168d6ad702abc7222 HTTP_Shib-Authentication-Method: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport Host: pf01.organizationuniversity.netedu:8080 HTTP_Shib-Authentication-Instant: 2015-09-22T13:32:32.084Z HTTP_givenName: Hank HTTP_persistent-id: https://idp.organizationuniversity.netedu/idp/shibboleth!https://powerfolder.organizationuniversity.netedu/sp!4OTxOV/aW/40nA3nKt7PHNm8CW0= HTTP_sn: Moody HTTP_Shib-AuthnContext-Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport HTTP_Shib-Session-Index: _33f3332851e83f64498e764555fd9d3f HTTP_Shib-Application-ID: default HTTP_mail: hank.moody@kitmoody@university.edu HTTP_eppn: zz9999@kitzz9999@university.edu HTTP_affiliation: employee@organizationemployee@university.netedu;member@organizationmember@university.netedu |