eduPersonScopedAffiliation not mapping correctly

[Cantor, Scott]

On 12/19/11 3:04 PM, "Scott Klawitter" <sklawitter at ebsco.com> wrote:
>
>Here is the log information from shibd.log that I have. Any and all help
>would be greatly appreciated.

Assuming ePSA's OID is the one referenced (it probably is, I just don't
have them memorized), then the problem is the NameFormat is wrong. The
defined value for that attribute is the URI constant in SAML, not
"unspecified".

Pending a future version of the SP that treats "unspecified" more
liberally because so many non-Shib IdPs violate the rules, you have to
insist on correctness or add mappings that handle non-standard names. In
this context, name means "the Name and NameFormat" together. SAML
attributes have two-part names, unfortunately.

The documentation covers how to create mappings for non-URI attribute
names, you add nameFormat to the rule. But if you want my advice, it's to
insist on standards, not to accomodate IdP bugs. Standards go both ways.
We bitch more often about SPs doing weird stuff, but you're just as
vulnerable to the problem.

-- Scott