[JIRA] Created: (SSPCPP-524) Default attribute-map.xml Attribute/id are misleading

[Olivier Salaun (JIRA)]

Default attribute-map.xml Attribute/id are misleading
-----------------------------------------------------

                 Key: SSPCPP-524
                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-524
             Project: Shibboleth SP - C++
          Issue Type: Improvement
      Security Level: Standard (Standard bug, may impact functionality but does not represent a security vulnerability )
          Components: Attribute Resolution / Filtering
    Affects Versions: 2.5.0
            Reporter: Olivier Salaun
            Assignee: Scott Cantor
            Priority: Minor


Default distributed attribute-map.xml maps SAML attributes to environment variables that are sometimes misleading. The worst example being eduPersonScopedAffiliation mapped to affiliation and eduPersonAffiliation mapped to unscoped-affiliation. 

This is a problem because it leads to communication problems between SP admins and IdP admins OR between end users and IdP admins. Example: an SP admins tells an IdP admin that it requires the affiliation attribute whereas it means eduPersonScopedAffiliation. It goes down to end-users because an error message from an SP-protected application may tell the user what user attributes it is missing, thus allowing the end-user to contact his IdP admin.

I knwow it's hard to change defaults, but I'd suggest you adopt a default attribute-map.xml file that keeps the attribute name as defined in eduPerson.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira