This assumes that you already have the Shibboleth IdP installed. If you haven't done that yet you can read how to set it up at Install CAF FedSSO (Shibboleth) w/ idp-caf-installer
Allow the following attributes to be released from our Identity Provider (IdP) to a Service Provider (SP). In this case I'll be giving access to testshib.org and CAF (eduroam). Since I don't have an SP I use testshib.org so I can see what gets processed on the SP side.
- eduPersonTargetedID: unique id autogenerated by Shibboleth
- eduPersonPrincipalName: if you’re using the CAF installer, this will be built from the “sAMAccountName” field in AD with @domain.ca on the end (for example, “[email protected]”)
- mail: email address, comes from “mail” field in AD (example: [email protected])