OpenConext / OpenConext/OpenConext-engineblock
Make original IdP attributes availabe in Attribute Manipulation
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 17
- Forks
- 25
- Avg merge
- 4d 1h
- Merged PRs (30d)
- 1
Description
In the AM, we currently do not have access to the unfiltered attributes from the Assertion as sent by the IdP.
We do have $response["__"]["OriginalRepsonse"]["saml:AttributeStatement"] but that does not seem to contain the full unfitlered attributes. Specifically, any attributes that are not in the SP's ARP are missing.
So, make a new (readonly) variable $idpAttributes available to the manipulation script what we can use to make specific exceptions to the ARP.
usecase
In test2, we want regular IdPs to get surf-autorizations and surf-crm-id from the AA. Only for the DIY-IdP, we want some of the users to have specific values set for these attributes.
This would be doable with an AM, if we can see the values the IdP is giving.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Attribute Manipulation handling and how the Assertion's attributes are currently exposed through $response["__"]["OriginalRepsonse"]["saml:AttributeStatement"]. Add a readonly $idpAttributes value containing the unfiltered IdP attributes, then verify that manipulation scripts can use it for exceptions to the SP's ARP, including the stated test2 use case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100