<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
                xmlns:xalan="http://xml.apache.org/xalan" 
                xmlns:stsuuser="urn:ibm:names:ITFIM:1.0:stsuuser" 
                xmlns:mapping-ext="com.tivoli.am.fim.trustserver.sts.utilities.IDMappingExtUtils" 
                extension-element-prefixes="mapping-ext" 
                version="1.0">
  <xsl:strip-space elements="*" />
  <xsl:output method="xml" version="1.0" encoding="utf-8" indent="yes" />
  
  <!-- Initially we start with a copy of the document. -->
  <xsl:template match="@* | node()">
    <xsl:copy>
      <xsl:apply-templates select="@* | node()" />
    </xsl:copy>
  </xsl:template>

  <!-- 
  Retrive the email address from the LDAP using extended attributes by modifying the webseal instance configuration file.
  
  [TAM_CRED_ATTRS_SVC]
  eperson = azn_cred_registry_id
 
  [TAM_CRED_ATTRS_SVC:eperson]
  email = mail
  -->

  <xsl:template match="//stsuuser:AttributeList">
    <stsuuser:AttributeList>
      <stsuuser:Attribute name="AuthnContextClassRef" type="urn:oasis:names:tc:SAML:2.0:assertion">
        <stsuuser:Value>
          urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </stsuuser:Value>
      </stsuuser:Attribute>
      
      <!-- Add the Email Address -->
      <stsuuser:Attribute name="IDPEmail">
        <stsuuser:Value>
          <xsl:value-of select="stsuuser:Attribute[@name='tagvalue_email']"/>
        </stsuuser:Value>    
      </stsuuser:Attribute>      
    </stsuuser:AttributeList>
  </xsl:template>
</xsl:stylesheet>