From 8105c6d1378444d9af77340d38eaac8786bce938 Mon Sep 17 00:00:00 2001
From: Paul Scott <paul.scott@kau.se>
Date: Thu, 25 Jan 2024 10:07:40 +0000
Subject: Optional script to remove invalid chars from subject-id

---
 Shibboleth-IdP/v4/attribute-resolver.xml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

(limited to 'Shibboleth-IdP/v4')

diff --git a/Shibboleth-IdP/v4/attribute-resolver.xml b/Shibboleth-IdP/v4/attribute-resolver.xml
index 5171017..391e687 100644
--- a/Shibboleth-IdP/v4/attribute-resolver.xml
+++ b/Shibboleth-IdP/v4/attribute-resolver.xml
@@ -453,6 +453,33 @@
         <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" friendlyName="subject-id" encodeType="false" />
     </AttributeDefinition>
 
+    <!-- Schema: SAML Subject ID Attributes -->
+    <!-- Use this if your idp.persistentId.sourceAttribute contains invalid characters like underscore or full stop (period).
+    <AttributeDefinition id="preSamlSubjectID" xsi:type="ScriptedAttribute">
+        <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}"/>
+        <Script><![CDATA[
+            logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.eppnbuilder");
+                // Script to replace underscore with %5F
+                try {
+                        // If idp.persistentId.sourceAttribute is not uid, then you need to amend the content of the script
+                        source=uid.getValues().get(0);
+                        source=source.replaceAll("_", "=5F");
+                        source=source.replaceAll("[\.]", "=2E");
+                        preSamlSubjectID.getValues().add(source);
+                }
+                catch(err) {
+                        logger.info("Error: " + err);
+                }
+                ]]>
+        </Script>
+    </AttributeDefinition>
+
+    <AttributeDefinition xsi:type="Scoped" id="samlSubjectID" scope="%{idp.scope}">
+        <InputAttributeDefinition ref="preSamlSubjectID" />
+        <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" friendlyName="subject-id" encodeType="false" />
+    </AttributeDefinition>
+    -->
+
     <AttributeDefinition xsi:type="Scoped" id="samlPairwiseID" scope="%{idp.scope}">
         <InputDataConnector ref="computed" attributeNames="computedId"/>
         <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:pairwise-id" friendlyName="pairwise-id" encodeType="false" />
-- 
cgit v1.2.3