SP: de-duping resolver plugin

[Martin Haase]

(taking this to dev from
https://issues.shibboleth.net/jira/browse/SSPCPP-466 a per Scott's
suggestion.)

I'm preparing a sample SP configuration for several applications I do
not know beforehand. They use the SimpleAggregationAttributeResolver to
query attributes from a central IdP. If both a campus IdP and the
central one did not provide some set of necessary attributes, the user
is redirected to a registry SP where they fill in the missing
attributes, into the same LDAP the central IdP takes them from.
There are two alternatives: Either the campus IdP didn't provide them,
then they come only from the central IdP, hence no duplicates. Or, if
the campus IdP provided them, they eventually come from both IdPs and
need to be merged.
Thus it is not about multi-valued attributes in general, which is up to
the application to honor or not. E.g. if the campus IdP asserts
givenNames John and Joe, these two get registered in the central LDAP,
and will be released from the central IdP as well, leading to
"John;Joe;John;Joe". I could imagine two ways to handle that: a) merging
duplicates if they come from multiple attribute resolvers, or b)
irrespective of the source, optionally let only unique values pass to
the application. (I'd prefer a)...)

Cheers,
Martin

>
>       Description
>
> Request for an attribute resolver plugin that eliminates duplicate
> values. See
> http://comments.gmane.org/gmane.comp.web.shibboleth.user/18350 , which
> already has 2 users that would like to have this functionality. +1
> from my use case, also with a SimpleAggregationAttributeResolver.
>
> <https://issues.shibboleth.net/jira/browse/SSPCPP-466#>
> Scott Cantor
> <https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu>
> added a comment - 16/Jun/12 6:30 PM
>
> This turns out to be a very ambiguous issue, which is why the
> duplicates exist. The SP just isn't designed to solve the "problem"
> well, and I'm not clear yet what the problem actually is. I would
> suggest taking this to the dev list. There are multiple places where
> some kind of code could be added, but nothing that wouldn't create
> ambiguities because of the features for aliasing of attributes.
>
> There are two cases I see:
>
>   * you require a single-valued variable/header
>   * you don't
>
> If the former, then it seems like duplicates aren't really the
> problem, because multiple, different values will be just as much an
> issue for you. If the latter, you have no issue, since handling
> multiple values requires the same work whether there are duplicates or
> not.
>
> So I'm wondering, I guess, if this is really about single values, and
> not duplicates.
>

-- 
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2332 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/dev/attachments/20120618/4953e2b3/attachment.bin