coordinating an SP with multiple IdPs

[Cantor, Scott]

On 3/1/12 9:39 PM, "Adam Cohen" <adamcohen at berkeley.edu> wrote:

>This discussion also led me to another question though: if the IdP's
>person identifier attribute (say they call it "foo") is not already
>defined in attribute-map.xml then I would have to add it with its oid or
>mace format identifier.

Well, you have to add its name. What that is depends on the NameFormat in
use and the name that's chosen or assigned by whomever is naming the SAML
attribute. We use URIs, and profiles that defer to LDAP/X.500
nomenclature, which are OIDs. Other people use any old thing they feel
like.

>Is there anything to prevent me from naming that attribute for my own
>convenience?   If not, then I could assign my name "eppn" to their
>oid/mace identifier for the attribute instead of "foo" and then the SP
>would have my name for the value.

What you map from and to is up to you. The defaults are simply defaults.
The only formal definitions apply to the SAML names. Local names are a
local decision.

>Then set REMOTE_USER="eppn" in shibboleth2.xml and don't have to worry
>about which attribute gets selected and possibly getting an unexpected
>value being sent over to the app.

Actually, you're creating exactly that possibility by doing that. If one
of the IdPs starts sending two different SAML attributes both of which you
happen to map into a local alias of "eppn", then you have no control over
which one will populate REMOTE_USER.

If you map them into separately named local attributes (call them "first"
and "second"), then the precedence rule in the REMOTE_USER setting
controls which one is favored and can ensure that "first" is always used
if its available.

All the REMOTE_USER setting does is automate this:

string username = null;
if (first)
	username = first;
else if (second)
	username = second;

Your proposed approach means that a single value collection called "eppn"
will have either or both values present and one of them at random will be
used.

Sometimes it's the right thing to do and sometimes it's not. That's why
the indirection is available in multiple places.

-- Scott