Multiple Account support for AWS Federation and Shibboleth

attribute-resolver.xml

    <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
                                   nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
                                   nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition id="awsRoles" xsi:type="ad:Mapped" sourceAttributeID="memberOf">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder
                xsi:type="enc:SAML2String"
                name="https://aws.amazon.com/SAML/Attributes/Role" friendlyName="Role"/>
        <ad:ValueMap>
            <ad:ReturnValue>arn:aws:iam::$1:saml-provider/Shibboleth,arn:aws:iam::$1:role/Shibboleth-$2</ad:ReturnValue>
            <ad:SourceValue>CN=AWS-([0-9]{1,})-([^,]*),.*</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition id="awsRoleSessionName" xsi:type="ad:Simple" sourceAttributeID="userPrincipalName">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder
                xsi:type="enc:SAML2String"
                name="https://aws.amazon.com/SAML/Attributes/RoleSessionName"
                friendlyName="RoleSessionName"/>
    </resolver:AttributeDefinition>