Any SCHAC attributes we should add to default mappings?

[Jehan PROCACCIA]

Hello 

in my institution (French telecom higher education schools), we use shacUserStatus and shacProjectMembership . 
if it can help . 

Regards . 

Jehan PROCACCIA 
Ingénieur systemes et réseaux 
Membre du comité de pilotage REVE: 
Réseau d’Évry Val d'Essonne 
+33160764436 

9 rue Charles Fourier - 91011 Evry Cedex 
[ https://www.imt-bs.eu/ | www.imt-bs.eu ] - [ https://www.imt-bs.eu/ | www.telecom-sudparis.eu ] 

----- Mail original ----- 
De: "Peter Schober" <peter.schober at univie.ac.at> 
À: dev at shibboleth.net 
Envoyé: Lundi 11 Juin 2018 18:13:48 
Objet: Re: Any SCHAC attributes we should add to default mappings? 

* Cantor, Scott <cantor.2 at osu.edu> [2018-06-11 16:49]: 
> Thanks, I'll get commented rules added before final release, keep any requests coming. 

Note that the shib dev list may not be the best forum to gauge usage 
of SCHAC attributes. And most attributes will be used by someone, 
somewhere, for some obscure use-case or another. 

schacHomeOrganizationType still suffers from all the issues I 
documented years ago, AFAICT: 

"For schacHomeOrganizationType one finds different values in the old 
registry, the new registry, the PDF specification and the LDAP schema 
file. This is very confusing and should be harmonized and kept 
consistent. The easiest way to achive this is to have a single version 
(i.e., document) of the spec, also containing relevant bits from the 
LDAP-schema." -- https://wiki.refeds.org/display/STAN/SCHAC+Plan 

See the mess from only a few federations reporting their usage: 
https://wiki.refeds.org/display/STAN/SchacHomeOrgType+usage 
(Ignore everything with swissEduPersonHomeOrganizationType in it, 
those are not SCHAC attributes and have nothing to do with the survey 
or topic at hand.) 

Earliest discussions I could find about this (e.g. "Vocabulary for 
schacHomeOrganizationType") go back until 2006, so those issues have 
been around for over a decade, with no signs of sudden improvements. 

The most recent thread I could find is from 2014: 
https://www.terena.org/mail-archives/schac/msg00543.html 
which seems to suggest that 
* schacHomeOrgType may not be suitable for authZ purposes since it was 
changed to be multi-valued, 
* what's left of that use-case (in combination with ePA/ePSA) has 
been taken over by the "academic IDP" entity category, as said 
earlier. I.e, the "academic IDP" category has taken a subset of the 
larger schacHomeOrgType problem space and did somethign about 
it. (Which ironically also hasn't lead anywhere, AFAICT.) 

Unless the inconsistencies in the controlled vocabulary are removed I 
think one can only recommend against using this attribute in 
large-scale deployments, esp internationally. Every thread about SCHAC 
in the last 10 years seem to come to that conslusion, I have the 
impression. 

-peter 
-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180611/c882cbc3/attachment-0001.html>