Please explain what attribute_map_dir maps are for?

[anentropic]

What are the fro attributes and what are the to attributes?

In basic.py you have:

MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
    "fro": {
        'urn:mace:dir:attribute-def:aRecord': 'aRecord',
        ...
    }
}

Is the left side a SAML attribute name and the right side a Python dict key? or they are both in the SAML realm?

I am setting up an IdP which needs to be compatible with assertions in the form:

<saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="FirstName">
    <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">SAML</saml:AttributeValue>
</saml:Attribute>

I'm guessing my map would be:

MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
    "fro": {
        'FirstName': 'FirstName',
        ...
    }
}

Do I even need a map?

[anentropic]

Ok from reading the source it looks the right hand side is used as a Python dictionary key

But what is the significance of this value? Why can't the original string be used as the dict key? Where is the dictionary consumed? Does the translated key have to match something in my own code - can I choose, or it has to match some SAML standard somewhere?

[rohe]

4 sep 2013 kl. 13:38 skrev anentropic notifications@github.com:

What are the fro attributes and what are the to attributes?

In basic.py you have:

MAP = {
"identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
"fro": {
'urn:mace:dir:attribute-def:aRecord': 'aRecord',
...
}
}

Is the left side a SAML attribute name and the right side a Python dict key? or they are both in the SAML realm?

The left side is the name in the given namespace (== identifier) in this case urn:oasis:names:tc:SAML:2.0:attrname-format:basic.
The right hand side is the attribute names you want to use in your application.

So, it's from the attribute specification in the SAML messages and to the local attribute specification.

If you are a SP and have received an AuthenticationResponse, then if you look at
the python representation of that response (instance of src/saml2/response/AuthnResponse)
response.ava is a dictionary with the 'to' attribute names as keys.

I am setting up an IdP which needs to be compatible with assertions in the form:

<saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="FirstName">
<saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">SAML/saml:AttributeValue
/saml:Attribute

In the case you being the IdP then the interesting part is the MAP["to"] dictionary which then
is the mapping from your local attribute names to the names that should be used in SAML message.
For instance if you have a LDAP directory as the source of the identity information then givenName
is probably where you would store the equivalent of the SAML base FirstName.

Hence you would have

MAP = {
"identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
"to": {
"givenName": "FirstName",
...
}
}

The 'fro' part is not so interesting in the IdP case.
It's only use would be if the SP is specifying in the metadata which attributes it wants to receive.
The 'to' dictionary on the other hand is use every time your IdP wants to send something.

-- Roland
"Education is the path from cocky ignorance to miserable uncertainty.” - Mark Twain

[anentropic]

Many thanks for your quick reply!

I am using pysaml2 as part of djangosaml2... the identities I want to provide come from Django models/db

From what I can tell, their SAML_ATTRIBUTE_MAPPING setting further maps from pysaml2 dict key to Django model attributes https://bitbucket.org/lgs/djangosaml2#rst-header-user-attributes

So my pysaml2 mapping could be 1:1 ...do I still need to specify it? eg

MAP = {
"identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
"to": {
    "FirstName": "FirstName",  # <-- do I even need this?
        ...
    }
}
# and on the djangosaml2 side:
SAML_ATTRIBUTE_MAPPING = {
    'FirstName': ('given_name', ),
}