Efficiency in AttributeDefinitions

[Bennett, Steve]

Hi,

I'm setting up a new SP which seems to require custom attribute names (it's an appliance, and even though I'm sure it's capable of doing name mapping on the SP, we're trying to follow vendor recommendations at this point).

As I understand it, this means that I need to have additional AttributeDefinition elements, i.e. even though I already have 'givenName' defined:
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="givenName" sourceAttributeID="givenName">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
    </resolver:AttributeDefinition>

This SP wants the attribute delivered as 'firstname', so I have an additional AttributeDefinition of:
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-givenName"
                                                       sourceAttributeID="givenName">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="firstname"
                                   nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

This works, but I'm wondering if there's a better way to do this, i.e. some way to only resolve an attribute when the request is from a specific SP? Or is the overhead of this kind of processing so tiny that I don't need to worry about it?

Also along the same lines, each user has a telephoneNumber attribute that contains the number in E164 format (e.g. "+1 555 8675309") but the application requires the number to be provided in three attributes ("country", "area" and "local" parts). It seems that one way to do this is to have three separate Attribute Definitions:

    <resolver:AttributeDefinition xsi:type="ad:Mapped"
                                  id="webex-ophonecountry"
                                  sourceAttributeID="telephoneNumber">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="OPhoneCountry"
                                   nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ad:ValueMap>
            <ad:ReturnValue>$1</ad:ReturnValue>
            <ad:SourceValue>\+(\d+) (\d+) (\d+)</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Mapped"
                                  id="webex-ophonearea"
                                  sourceAttributeID="telephoneNumber">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="OPhoneArea"
                                   nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ad:ValueMap>
            <ad:ReturnValue>$2</ad:ReturnValue>
            <ad:SourceValue>\+(\d+) (\d+) (\d+)</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Mapped"
                                  id="webex-ophonelocal"
                                  sourceAttributeID="telephoneNumber">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="OPhoneLocal"
                                   nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ad:ValueMap>
            <ad:ReturnValue>$3</ad:ReturnValue>
            <ad:SourceValue>\+(\d+) (\d+) (\d+)</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>
Is there a better way to do this? Again, this is only being used by one SP, and I don't know if I should be caring about the efficiency of things like this.

Thanks in advance,

Steve Bennett, Lancaster University