decoders for eduPersonTargetedID

[Peter Schober]

Please keep replies to the list.
Answers below.

* Selvaraj, Dineshkumar (ELS-DAY) <dineshkumar.selvaraj at lexisnexis.com> [2012-10-24 18:49]:
> Below are the two forms of attribute
> 
> 1. StringAttributeDecoder decodes the below attribute, but NameIDAttributeDecoder fails to decode the attribute as there is no NameID in the attribute value
> 
> </saml2:Attribute><saml2:Attr
> ibute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attr
> name-format:uri"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">831527828712cd9
> 1as782609</saml2:AttributeValue></saml2:Attribute>
> 
> 2. NameIDAttributeDecoder decodes the below attribute, but StringAttributeDecoder fails to decode the attribute as the attribute value is not in string format (having child element saml2:NameID )
> 
> </saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:
> 1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue><saml2:NameID Format="urn:oasis:names:tc:SAML:2 .0:nameid-format:persistent" NameQualifier="testfed/shibboleth" SPNameQualifier="https://sdauth.sciencedirect.com/">jhahRERgsfjijksajhTghsajaahsstU/dXU =</saml2:NameID></saml2:AttributeValue></saml2:Attribute>
> 
> I tried using both the decoders in attribute-map.xml, but the
> decoder associate with first occurrence of matching
> name(urn:oid:1.3.6.1.4.1.5923.1.1.1.10) and id(eduPersonTargetedID )
> was taken for decoding. Is there a decoder which can parse above 2
> types of attributes, irrespective of the attribute value is string
> or NameID ?

I don't think so. For any attribute name there can only be one
decoder, AFAIK -- which makes sense, because any given attribute name
will only come in one /correct/ syntactial form (how should the
software differentiate those otherwise -- they have the same name and
the same name format).
You can map several different attributes (i.e., attribute names) to
the same internal id but not the other way round.

So it seems you can't hack around the IdP's faults here, i.e., you
will have to tell the IdP to clean up their mess and fix the broken
syntax.
-peter