CODEWITHSUNDEEP
phpsaml-2.0simplesamlphp
Luke O'Sullivan
Luke O'Sullivan

Reputation: 110

How do I map attributes returned by an IDP to friendly names inSimpleSAMLphp?

I have successfully configured simpleSAMLphp so that it authenticates via the Test Shib IDP (https://www.testshib.org/).

Test Shib returns the following attributes:

enter image description here

I would like to map these attributes to friendly names. Can anyone give me some pointers as to how to do that?

The default-sp example in authsources.php has the following:

/*
 * The attributes parameter must contain an array of desired attributes by the SP.
 * The attributes can be expressed as an array of names or as an associative array
 * in the form of 'friendlyName' => 'name'.
 * The metadata will then be created as follows:
 * <md:RequestedAttribute FriendlyName="friendlyName" Name="name" />
 */
 /*'attributes' => array(
   'attrname' => 'urn:oid:x.x.x.x',
 ),*/

But setting 

'attributes' => array('myTestValue' => 'urn:oid:0.9.2342.19200300.100.1.1'),

has no effect.

Any help will be very gratefully received!

Upvotes: 4

Views: 3684

Answers (2)

ObjectiveTruth
ObjectiveTruth

Reputation: 878

Assuming SimpleSAMLPHP 1.6 and higher, you can simply use the build in oid2name attributemap to do the mapping for you.

'authproc' => array( 50 => array( 'class' => 'core:AttributeMap', 'oid2name', ), ),

To add to Luke's answer, you can simply add an authproc filter in the following places:

  • Globally in config.php
  • On the SP: Specific for only the SP in authsources.php
  • On the SP: Specific for only one remote IdP in saml20-idp-remote or shib13-idp-remote
  • On the IdP: Specific for only one hosted IdP in saml20-idp-hosted or shib13-idp-hosted
  • On the IdP: Specific for only one remote SP in saml20-sp-remote or shib13-sp-remote

Taken from https://simplesamlphp.org/docs/stable/simplesamlphp-authproc

You can see additional AttributeMaps such as oid2urn and oid2feide in the source found here:

https://github.com/simplesamlphp/simplesamlphp/tree/master/attributemap

Upvotes: 3

Luke O&#39;Sullivan
Luke O&#39;Sullivan

Reputation: 110

According to https://simplesamlphp.org/docs/stable/simplesamlphp-authproc, the correct way to manipulate attributes is via the "authproc" functionality.

In my case, I added the following the configuration array for https://idp.testshib.org/idp/shibboleth in config/saml20-idp-remote.php:

'authproc' => array(
    50 => array(
        'class' => 'core:AttributeCopy',
        'urn:oid:0.9.2342.19200300.100.1.1' => 'uid',
    ),
),

The documentation suggests that this configuration array can be added in the following places:

  • Globally in config.php
  • On the SP: Specific for only the SP in authsources.php
  • On the SP: Specific for only one remote IdP in saml20-idp-remote or shib13-idp-remote
  • On the IdP: Specific for only one hosted IdP in saml20-idp-hosted or shib13-idp-hosted
  • On the IdP: Specific for only one remote SP in saml20-sp-remote or shib13-sp-remote

Please note that you may need to clear any sessions (close and reopen your browser) for the changes to work.

Top tip for future reference - always read the most current version of the documentation!

Upvotes: 2

Related Questions