Page Comparison

...

Shibboleth attribute names are case sensitive

Shibboleth.Attribute	PowerFolder.Field	Purpose	External links
Shib-Session-ID	-	Must be set for authenticating a valid Shibboleth session	wiki.shibboleth.net
persistent-id or uniqueID	Account.shibbolethPersistentID	Persistent external ID for retrieving/matching an existing PowerFolder account	wiki.shibboleth.net DFN AAI bwIDM
eduPersonPrincipalName or eppn or EPPN	Account.username	Persistent, external, unique username for retrieving an existing account	internet2.edu bwIDM
mail or email	Account.emails	Email address(es) of user. Multiple mail address should be separated by ; (semicolon). Matches existing PowerFolder accounts unless turned off in config: shibboleth.accounts.match_email=false	bwIDM

scopedUsername or

bwScopedUsername

Account.username

Persistent, external, unique username for retrieving an existing account

Obsolete. Will be removed in the future

givenName	Account.firstname	Given name of the user	bwIDM
surname or sn	Account.surname	Surname of the user	bwIDM
o or

(attribute name as in config)

organizationName

Account.organization and

Account.custom2 (if unmapped)

Organization (name) of user.

Auto-creates organizations within PowerFolder unless turned off in config:

shibboleth.create.organizations=false

Organization attribute name can be alternated by config:

shibboleth.organizations.attribute=customOrgAttrib

bwIDM

affiliation or

eduPersonScopedAffiliation

Account.custom1

Affiliation

Affiliation of user

bwIDM

entitlement or

eduPersonEntitlement

-

Must match the entitlement value if set in PowerFolder config:

shibboleth.entitlement=http://example.entitlement

(by default no entitlement value is set, which means disabled entitlement check)

bwIDM


(attribute names as in config)	Account.custom2	Free mapping field. Not mapped by default. Use configuration entry to set mapping
(attribute names as in config)	Account.custom3	Free mapping field. Not mapped by default. Use configuration entry to set mapping
(attribute names as in config)	Account.expirationDate	Free mapping field. Not mapped by default. Use configuration entry to set mapping Format: ISO 8601 or Unix timestamp or yyyyMMddHHmmss	2016-12-23T13:37:69.107Z 20161231133769
scopedUsername or bwScopedUsername	Account.username	Persistent, external, unique username for retrieving an existing account Not longer mapped by default since 10.5. To remap use attribute configuration
REMOTE_USER	Account.username

Obsolete

?

. Persistent external username for retrieving an account.

Configuration of Shibboleth-Attribute names

Info
The SAML/Shibboleth-Attribute names can be configured if necessary under Preferences/Shibboleth or in configuration file.

Example web request with attributes

Code Block

title	Headers of request GET to /login/shibboleth:

HTTP_Shib-Identity-Provider: https://idptest.scc.kituniversity.edu/idp/shibboleth
HTTP_o: organization
REMOTE_USER: zz9999@kitzz9999@university.edu
HTTP_entitlement: http://idm.org/entitlement/organization-PowerFolder
HTTP_Shib-Session-ID: _01309f0985d68b0168d6ad702abc7222
HTTP_Shib-Authentication-Method: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Host: pf01.organizationuniversity.netedu:8080
HTTP_Shib-Authentication-Instant: 2015-09-22T13:32:32.084Z
HTTP_givenName: Hank
HTTP_persistent-id: https://idp.organizationuniversity.netedu/idp/shibboleth!https://powerfolder.organizationuniversity.netedu/sp!4OTxOV/aW/40nA3nKt7PHNm8CW0=
HTTP_sn: Moody
HTTP_Shib-AuthnContext-Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
HTTP_Shib-Session-Index: _33f3332851e83f64498e764555fd9d3f
HTTP_Shib-Application-ID: default
HTTP_mail: hank.moody@kitmoody@university.edu
HTTP_eppn: zz9999@kitzz9999@university.edu
HTTP_affiliation: employee@organizationemployee@university.netedu;member@organizationmember@university.netedu

Versions Compared

Old Version 8

New Version Current

Key

Configuration of Shibboleth-Attribute names

Example web request with attributes