Building a composite attribute from sets of attributes

[Cantor, Scott]

> In order to keep the structure, we want to send all affiliations as JSON-structured data in
> one SAML attribute.

I really wouldn't.

I think the essential issue is: who cares about this distinction? My guess is nobody will; the history of this sort of thing is that we think apps care about lots of things but apps care about nothing most of the time. So assuming they care and doing lots of work to let them care is usually premature.

if you have specific knowledge of them caring, then we can talk about it.

Note that scoped attributes were designed to already support this anyway.

In the meantime, there's a SAML extension defined for this use case called "OriginalIssuer". It's an XML attribute that can be added to <saml:Attribute> that carries the identity of a upstream issuer that's distinct from the assertion issuer.

Nothing supports this today because of point #1 (nothing cares). But it's relatively easy for us to add support for it if it's needed. I had already planned on probably looking at it for V4 beause of the proxying work. We just have to capture it in IdPAttribute, obviously.

-- Scott