asserting eduPersonTargetedID from SAML frontend - Satosa-dev

21 May 2019

      Hi,

I require the SATOSA SAMLFrontend to assert the following XML for
eduPersonTargetedID as part of an <AttributeStatement>

<Attribute FriendlyName="eduPersonTargetedID"
     Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
     NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
     <AttributeValue>
         <NameID
             Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
             NameQualifier="https://proxy.my.org/idp/satosa"
             SPNameQualifier="https://service.my.org/sp/shibboleth">
             1088878806
         </NameID>
     </AttributeValue>
</Attribute>

Here the value 1088878806 for <NameID> is to be taken from a database (I will
be using an LDAP directory, but in general it is being pulled from some
storage), the NameQualifier is the entityID for the SATOSA proxy IdP frontend
(the SAMLFrontend instance), and the SPNameQualifier is the entityID for the SP
that sent the <AuthnRequest> to the SATOSA proxy IdP frontend.

Has anybody configured the existing SATOSA and pysaml2 code to assert such
XML?  If so can you share some details of your configuration?

If not, is anybody using modified SATOSA or pysaml2 code that has not been
contributed yet to assert such XML and is willing to share and/or collaborate
on getting it contributed (relatively quickly)?

Thanks,

Scott K

P.S. I am fully aware that there are reasons to deprecate the use of
eduPersonTargetedID. For this particular deployment I need to assert this
attribute for the time being using SATOSA.