Add subject and pairwise-id

config/logins.json

@@ -8,6 +8,8 @@
         "uid": [
           "jstiglitz"
         ],
+	"pairwise-id": "jstiglitz",
+	"subject-id": "jstiglitz",
         "eduPersonTargetedID": "bd0916qef0c2e675b2def4ahe6w50b7d4bb4aae",
         "schacHomeOrganization": "harvard-example.edu",
         "eduPersonPrincipalName": "stiglitz@harvard-example.edu",

metadata/saml20-idp-hosted.php

@@ -94,14 +94,27 @@ $metadata['__DYNAMIC:1__'] = [
 	  'identifyingAttribute' => 'eduPersonTargetedId',
 	  'nameId' => TRUE,
 	],
-        8 => [
+	8 => [
+	  'class' => 'subjectidattrs:PairwiseID',
+	  'identifyingAttribute' => 'pairwise-id',
+          'scopeAttribute' => 'scope',
+	],
+	9 => [
+	  'class' => 'subjectidattrs:SubjectID',
+	  'identifyingAttribute' => 'subject-id',
+          'scopeAttribute' => 'scope',
+	],
+        15 => [
           'class' => 'core:PHP',
           'code' => '
             unset($attributes["eduPersonTargetedId"]);
+            unset($attributes["pairwise-id"]);
+            unset($attributes["subject-id"]);
+            unset($attributes["scope"]);
           ',
-        ],	
+	],
         // Convert LDAP names to urn.
-	10 => [
+	20 => [
 	  'class' => 'core:AttributeMap',
 	  'name2oid'
 	],

modules/customauth/www/authpage.php

@@ -68,6 +68,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
     $attributes = @$_POST['keys'] or [];
 
+    // Fix subject scope
+    $scope = "dummy.org";
+    if (isset($attributes['schacHomeOrganization'])) {
+        $scope = $attributes['schacHomeOrganization'];
+    } elseif (isset($attributes['eduPersonScopedAffiliation'])) {
+        $scope = explode("@", explode(",", $attributes['eduPersonScopedAffiliation'])[0])[1];
+    } elseif (isset($attributes['eduPersonPrincipalName'])) {
+        $scope = explode("@", $attributes['eduPersonPrincipalName'])[1];
+    }
+    $attributes['scope'] = $scope;
+    //SimpleSAML\Logger::warning("Attributes: " . print_r($attributes, true));
+
     foreach ($attributes as $key => $value) {
         $_SESSION['attributes'][$key] = $value;
     }