<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 22, 2017, at 5:22 PM, Cantor, Scott <<a href="mailto:cantor.2@OSU.EDU" class="">cantor.2@OSU.EDU</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">I know all the profiles one start with the following, but this isn't a profile one.<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Ah, yes, subtle point. The point of the property prefixes isn't really to target the specific settings by name but to target the setting that would apply to that request. In other words, it builds the property to look for by using the current request's profile ID. So nominally you could even vary the responderId by profile with this trick just like if you were doing it with a lookup function.</span></div></div></blockquote></div><div class=""><br class=""></div>Thanks. So one that would apply to all profiles would just be the following, correct?<div class=""><br class=""></div><div class=""> <a href="http://shibboleth.net/ns/profiles/responderId" class="">http://shibboleth.net/ns/profiles/responderId</a></div><div class=""><br class=""></div><div class="">I'd also like to bring up attribute release, and see what the Shib team thinks of the following. I know that at least you (Scott) have given this some thought in the past. One could define a standard entity attribute name, and the values of that would be the "standard" ID/FriendlyNames (as in the attribute-resolver-full.xml) of the attributes to be released. And then, of course, distributing an attribute filter file with rules in it like the following:</div><div class=""><br class=""></div><div class=""><div class=""><AttributeFilterPolicy id="release_EPPNtoTagged"></div><div class=""> <PolicyRequirementRule xsi:type="EntityAttributeExactMatch" </div><div class=""> attributeName="<a href="http://id.incommon.org/category/attributeRelease/releaseAllValues" class="">http://shibboleth.net/ns/attributes/releaseAllValues</a>" </div><div class=""> attributeValue="eduPersonPrincipalName" /></div><div class=""> <AttributeRule attributeID="eduPersonPrincipalName"></div><div class=""> <PermitValueRule xsi:type="ANY" /></div><div class=""> </AttributeRule></div><div class=""></AttributeFilterPolicy></div><div class=""><br class=""></div><div class="">etc. </div><div class=""><br class=""></div><div class="">The other option would be to define an entity attribute name per attribute, but I don't see the advantage in that unless one was going to somehow work "values to be released of a given attribute" into that. (Although I'm sure how one would leverage those values in pre-embedded release rules. And trying to go down to the level of per-value control thru entity attribute tagging seems a step too far.)</div><div class=""><br class=""></div><div class="">What do you think? Does the Shib team want to define one or more entity attribute names that could potentially be leveraged as one option to control attribute release? Would you prefer the value set of such an entity attribute to be the urn:oid form of the names, rather than the FriendlyNames? Have you had some different model for such tagging in mind?</div><div class=""><br class=""></div><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>