>> Are there a set of 'radius' attribute names I should use when mapping the SAML attributes ?
>
> The complete assertion goes in SAML-AAA-Assertion (vendor is UKERNA, 25622; attribute ID is 132 -- grab dictionary.ukerna out of mech_eap). You'll need to split it across multiple RADIUS AVPs. You shouldn't need to add other AVPs.
Just to be clear: extracting and mapping the SAML attributes is not your responsibility, this is done by Shibboleth on the acceptor (if at all). You just need to put the entire assertion in a RADIUS AVP (fragmented, as I mentioned, across multiple AVPs because there is a [IIRC] 253 byte limit on each value).
-- Luke
|