Attributes and web requests

Attribute mapping

= Mandatory attribute to validate an shibboleth login / session.

Shibboleth attribute names are case sensitive

Shibboleth.Attribute	PowerFolder.Field	Purpose	External links
Shib-Session-ID	-	Must be set for authenticating a valid Shibboleth session	wiki.shibboleth.net
persistent-id or uniqueID	Account.shibbolethPersistentID	Persistent external ID for retrieving/matching an existing PowerFolder account	wiki.shibboleth.net DFN AAI bwIDM
eduPersonPrincipalName or eppn or EPPN	Account.username	Persistent, external, unique username for retrieving an existing account	internet2.edu bwIDM
mail or email	Account.emails	Email address(es) of user. Multiple mail address should be separated by ; (semicolon). Matches existing PowerFolder accounts unless turned off in config: shibboleth.accounts.match_email=false	bwIDM
givenName	Account.firstname	Given name of the user	bwIDM
surname or sn	Account.surname	Surname of the user	bwIDM
o or organizationName	Account.organization and Account.custom2 (if unmapped)	Organization (name) of user. Auto-creates organizations within PowerFolder unless turned off in config: shibboleth.create.organizations=false Organization attribute name can be alternated by config: shibboleth.organizations.attribute=customOrgAttrib	bwIDM
affiliation or eduPersonScopedAffiliation	Account.custom1	Affiliation of user	bwIDM
(attribute names as in config)	Account.custom2	Free mapping field. Not mapped by default. Use configuration entry to set mapping Available since 10.5
(attribute names as in config)	Account.custom3	Free mapping field. Not mapped by default. Use configuration entry to set mapping Available since 10.5
(attribute names as in config)	Account.expirationDate	Free mapping field. Not mapped by default. Use configuration entry to set mapping Available since 10.5. Format: ISO 8601 or Unix timestamp or yyyyMMddHHmmss	2016-12-23T13:37:69.107Z 20161231133769
entitlement or eduPersonEntitlement	-	Must match the entitlement value if set in PowerFolder config: shibboleth.entitlement=http://example.entitlement (by default no entitlement value is set, which means disabled entitlement check) The entitlement attribute is optional and should only be set, if it's sent/used by the IdP.	bwIDM
scopedUsername or bwScopedUsername	Account.username	Persistent, external, unique username for retrieving an existing account Not longer mapped by default since 10.5. To remap use attribute configuration
REMOTE_USER	Account.username	Obsolete. Persistent external username for retrieving an account.

Configuration of Shibboleth-Attribute names

The SAML/Shibboleth-Attribute names can be configured if necessary under Preferences/Shibboleth or in configuration file.

Example web request with attributes

Headers of request GET to /login/shibboleth:

HTTP_Shib-Identity-Provider: https://idptest.university.edu/idp/shibboleth
HTTP_o: organization
REMOTE_USER: zz9999@university.edu
HTTP_entitlement: http://idm.org/entitlement/organization-PowerFolder
HTTP_Shib-Session-ID: _01309f0985d68b0168d6ad702abc7222
Host: pf01.university.edu:8080
HTTP_givenName: Hank
HTTP_persistent-id: https://idp.university.edu/idp/shibboleth!https://powerfolder.university.edu/sp!4OTxOV/aW/40nA3nKt7PHNm8CW0=
HTTP_sn: Moody
HTTP_mail: hank.moody@university.edu
HTTP_eppn: zz9999@university.edu
HTTP_affiliation: employee@university.edu;member@university.edu