configuring meta-attributes in the Shib IdP

[Tom Scavo]

On Thu, Dec 3, 2015 at 5:14 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 12/3/15, 5:03 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>On 12/3/15, 4:33 PM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com>
>>>
>>>Then the following configuration at the IdP would recognize the above
>>>requested attributes:
>>>
>>><afp:AttributeFilterPolicy id="releaseEssentialAttributesToAnySP">
>>>
>>>  <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
>>
>>I don't believe that your way will work, but it might. I think it will be less efficient though.
>
> I think I'm wrong and you're right. I'd start with yours anyway. Mentally my way is making more sense to me...

The policy I sketched earlier was essentially the OSU IdP attribute
release policy (as I understand it) with the following twist: Release
the attributes listed in the policy if and only if the corresponding
meta-attributes are listed in metadata.

Here's a similar policy, for R&S IdPs:

<afp:AttributeFilterPolicy id="releaseRandSAttributeBundle">

  <afp:PolicyRequirementRule xsi:type="saml:EntityAttributeExactMatch"
      attributeName="http://macedir.org/entity-category"
      attributeValue="http://refeds.org/category/research-and-scholarship"/>

  <!-- assuming ePPN is non-reassigned -->
  <afp:AttributeRule attributeID="eduPersonPrincipalName">
    <afp:PermitValueRule xsi:type="saml:AttributeInMetadata"
        attributeName="http://id.incommon.org/attribute/metaPublicUserID"
        attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="displayName">
    <afp:PermitValueRule xsi:type="saml:AttributeInMetadata"
        attributeName="http://id.incommon.org/attribute/metaPersonName"
        attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="email">
    <afp:PermitValueRule xsi:type="saml:AttributeInMetadata"
        attributeName="http://id.incommon.org/attribute/metaEmailAddress"
        attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>
  </afp:AttributeRule>

</afp:AttributeFilterPolicy>

This particular IdP releases ePPN + displayName + mail if and only if
the corresponding meta-attributes are listed in metadata. Another IdP
might release ePUId + givenName + sn + mail. Yet another IdP might
release OIDC claims. All we need to do is give precise definitions to
the meta-attributes so both parties are on the same page:

----
PUBLIC USER IDENTIFIER

FriendlyName: metaPublicUserID
Name: http://id.incommon.org/attribute/metaPublicUserID

A metaPublicUserID is a persistent, non-reassigned, non-targeted identifier.

An Identity Provider (or Attribute Authority) is said to release a
metaPublicUserID when it releases one of the following attributes on
the wire:

- eduPersonUniqueId attribute
- eduPersonPrincipalName attribute (if non-reassigned)
- OpenID Connect public sub claim

A Service Provider is said to request a metaPublicUserID when it does
so indirectly in metadata.

PERSON NAME

FriendlyName: metaPersonName
Name: http://id.incommon.org/attribute/metaPersonName

A metaPersonName is a human-readable name for the person (or subject)
involved in a federated transaction.

An Identity Provider (or Attribute Authority) is said to release a
metaPersonName when it releases at least one of the following
attributes (or attribute combinations) on the wire:

- eduPerson displayName attribute
- OpenID Connect name claim
- Two eduPerson attributes: givenName + sn (surname)
- Two OpenID Connect claims: given_name + family_name

A Service Provider is said to request a metaPersonName when it does so
indirectly in metadata.

EMAIL ADDRESS

FriendlyName: metaEmailAddress
Name: http://id.incommon.org/attribute/metaEmailAddress

A metaEmailAddress is an electronic mail address for the person (or
subject) involved in a federated transaction.

An Identity Provider (or Attribute Authority) is said to release a
metaEmailAddress when it releases one of the following attributes on
the wire:

- eduPerson mail attribute
- OpenID Connect email claim

A Service Provider is said to request a metaEmailAddress when it does
so indirectly in metadata.
----

Does that make sense?

Tom