# Passing SAML / Mellon atrritbutes to PUN

**URL:** <https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900>\
**Category:** Get Help\
**Tags:** question\
**Created:** [November 28, 2024, 12:15pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900 "2024-11-28T12:15:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dgtim](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/dgtim/32/2526_2.png) [@dgtim](https://discourse.openondemand.org/u/dgtim)\
**Post date:** [November 28, 2024, 12:15pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/1 "2024-11-28T12:15:01Z")

</div>

Hi All,

I’m somewhat new to OOD. Configuring the latest 3.1 with SAML / Mellon as idP. There are two attributes ‘MELLON\_urn:oid:0.9.2342.19200300.100.1.1’ for the UID and ‘MELLON\_urn:oid:0.9.2342.19200300.100.1.3’ for the user email. I’ve manager to define in the `config/ood_portal.yml`:

```auto
user_env: MELLON_urn:oid:0.9.2342.19200300.100.1.1
user_map_match: '.*'

```

this has allowed to get idP auth to work. The next would be propagating ‘MELLON\_urn:oid:0.9.2342.19200300.100.1.3’ attribute (==user email) to PUN.

Here is a solution to try: [How can I pass OIDC\_CLAIM\_EMAIL value to my applications?](https://discourse.openondemand.org/t/how-can-i-pass-oidc-claim-email-value-to-my-applications/2358) but only if I manage to map the SAML’s attribute to an environment variable and propagate it to PUN.

Tried next in the ood\_portal.yml:

```auto
custom_vhost_directives:
    - 'SetEnv OOD_USER_MAIL_ENV "MELLON_urn:oid:0.9.2342.19200300.100.1.3"'
pun_pre_hook_exports: "OOD_USER_ENV,OOD_USER_MAIL_ENV"

```

but a simple `pun_pre_hook_root_cmd` script with `printenv` gives me

```auto
...
OOD_OOD_USER_MAIL_ENV=MELLON_urn:oid:0.9.2342.19200300.100.1.3

```

There should be something simple that I miss…

My further idea for passing that idP provided attribute would be having a `pun_pre_hook_root_cmd` like

```auto
USEREMAILDIR="/dev/shm/emails"
[[-d "$USEREMAILDIR"]] || mkdir -m 755 "$USEREMAILDIR"

if [! -z ${OOD_USER_ENV+x}]; then
  EMAILFILE="${USEREMAILDIR}/${OOD_USER_ENV}"
  echo "${OOD_USER_MAIL_ENV:-none}" > "${EMAILFILE}"
  /bin/chown "$OOD_USER_ENV" "${EMAILFILE}"
  /bin/chmod 750 "${EMAILFILE}"
fi

```

and the reading that file through the initializer either globally or within the app that wants the user email.

What do I miss here? Or is there a better way to pass SAML’s attributes to PUN?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 2, 2024, 2:54pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/2 "2024-12-02T14:54:53Z")

</div>

> [@dgtim](#):
>
> What do I miss here? Or is there a better way to pass SAML’s attributes to PUN?

I think that’s about it.

---

<div class="post-metadata">

**Author:** ![dgtim](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/dgtim/32/2526_2.png) [@dgtim](https://discourse.openondemand.org/u/dgtim)\
**Post date:** [December 3, 2024, 9:19am UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/3 "2024-12-03T09:19:39Z")

</div>

Jeff, do you want to say that there a better way to do it?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 3, 2024, 3:24pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/4 "2024-12-03T15:24:32Z")

</div>

I can’t really think of one. That’s pretty much why the `pun_pre_hook_root_cmd` exists, to do stuff like this because we strip a lot of those sensitive headers (or they may not exist as headers at all).

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [December 3, 2024, 6:21pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/5 "2024-12-03T18:21:31Z")

</div>

I suppose you could also use the user\_map\_cmd shim script to modify the variable being passed as as std input from the auth mechanism before it hits apache but that might run a lot more often than the pun\_pre\_hook\_root\_cmd does?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 3, 2024, 6:24pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/6 "2024-12-03T18:24:31Z")

</div>

Yea `user_map_cmd` is going to run for every single request where `pun_pre_hook_root_cmd` only runs once when the PUN has to startup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [June 1, 2025, 6:24pm UTC](https://discourse.openondemand.org/t/passing-saml-mellon-atrritbutes-to-pun/3900/7 "2025-06-01T18:24:49Z")

</div>

Closed on June 1, 2025, 6:24pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.