Building a composite attribute from sets of attributes

[Etienne Dysli Metref]

On 06/08/2019 14.22, Cantor, Scott wrote:
> I think the essential issue is: who cares about this distinction? My
> guess is nobody will; the history of this sort of thing is that we
> think apps care about lots of things but apps care about nothing most
> of the time. So assuming they care and doing lots of work to let them
> care is usually premature.

I'm with you on this one. I have yet to see a written justification from
the app side and the only answer so far is "because the project manager
said so"... which I've kicked back into the discussion arena today. ;)

We only have three services that really need some affiliation data and
these are satisfied by sending them all eduPersonScopedAffiliation
values that we have. All three are operated by SWITCH and the one we are
working on now would be the first external service.

> In the meantime, there's a SAML extension defined for this use case
> called "OriginalIssuer". It's an XML attribute that can be added to
> <saml:Attribute> that carries the identity of a upstream issuer
> that's distinct from the assertion issuer.

Oh that's interesting! and it goes where we want to: group attributes
and their values by affiliation in a way that preserves their origin
information.

There is, however, one case where this falls short: when a university
issues separate accounts for a person that is both student and staff.
Here attributes from both accounts come from the same IdP so their
association with the staff or student role is lost. For example,
eduPersonUniqueId or email values from the student account and the staff
account would be mixed together. We would like to find a solution that
keeps these separate.

Do you have time for a call to discuss this? I'm not sure I managed to
correctly explain what we are doing and want to achieve in writing.

  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20190806/2b2d7c3e/attachment-0001.sig>