IdP Attribute resolver and filter question

[Christopher Bongaarts]

On 6/28/2012 2:57 PM, Michael A. Grady wrote:

> If I have two "<resolver:AttributeEncoder xsi:type="enc:SAML2String"
> for one AttributeDefinition in the IdP's attribute-resolver.xml, in
> order to have multiple names for that same source attribute, what is
> the corresponding attribute-filter.xml rule to release that attribute
> under just one of those names? Or is it automatically released under
> all those names, and its up to the the SP to just look for one
> particular one?

What we have done in cases where we want to release the same attribute 
under different names to different IPs:  We define an attribute to be 
encoded with the "standard/common" SAML name way as usual.  Then we 
define an additional attribute, as type Simple with the standard 
attribute as the source attribute (i.e. it's a copy of the original), 
encoded with the other SAML name.

Now you've got two IdP attributes that can be released independently 
from filters, based on request SP, phase of moon, etc.
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%