Disallow eppn/affiliation to be asserted by the wrong IdP

[Peter Schober]

* William Spooner <william.spooner at eaglegenomics.com> [2012-10-11 13:10]:
> A related question - my SP uses three fixed IdP providers, one Shib,
> one OpenSSO and one AD. The attributes they deign to provide differ,
> but some can be inferred directly from knowledge of the IdP,
> e.g. organizationname, affiliation etc. Is it possible to
> add/override attributes on a per-IDP basis?

* William Spooner <william.spooner at eaglegenomics.com> [2012-10-11 13:33]:
> To answer my other question (per-IdP constant Attribute values), I
> can add <Attribute> names/values directly to the MetadataProvider
> XML and use AttributeExtractor to hoik them out to be used to set a
> particular Attribute id. Hmm - I'll have to work on the XML for
> that.

If only the attribute names (on the wire) are different you can map
different attribute names to the same shib-internal attribute name.
If values need to be munged you'd best do that in the application,
I think.

Depending on what data you need the provided metadata might already
have it (e.g. MDUI stuff for a display name of the institution).
Adding stuff to your local copy of the metadata usually won't work as
is because (depending on the trust model used) you'll need to
regularly refresh the remote metadata (e.g. to learn about changed
keys or endpoints or supported protocols). So unless you'd merge
remote with local metadata (creating additional work for yourself)
you'd lose your local changes.
-peter