Efficiency in AttributeDefinitions

[Peter Schober]

* Bennett, Steve <s.bennett at lancaster.ac.uk> [2013-04-11 11:34]:
> As I understand it, this means that I need to have additional
> AttributeDefinition elements, i.e. even though I already have
> 'givenName' defined:
[...]
> This SP wants the attribute delivered as 'firstname', so I have an
> additional AttributeDefinition of:
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-givenName"
>                                                        sourceAttributeID="givenName">
>         <resolver:Dependency ref="myLDAP"/>
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="firstname"
>                                    nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
>     </resolver:AttributeDefinition>

Are you sure the NameFormat is unspecified? It might also be "basic".
Just saying.

> This works, but I'm wondering if there's a better way to do this,
> i.e. some way to only resolve an attribute when the request is from
> a specific SP? Or is the overhead of this kind of processing so tiny
> that I don't need to worry about it?

Conditional resolving has nothing to do with this issue as it's just
making an existing attribute (resolved for the definition with
id="givenName") available under a different name (unless that's the
/only/ attribute your IdP is pulling from LDAP, which I doubt).

The current IdP does not do conditional resolving, yes.

There are some hacks to make it do that, if you really want to (check
the list archives) and already have the numbers that prove it's
necessary (e.g. if you depend on direct queries to a known
broken/unreliable data source. Of course in such a case fixing the
data source or syncing it to a reliably query-able source would still
be better.)

> Also along the same lines, each user has a telephoneNumber attribute
> that contains the number in E164 format (e.g. "+1 555 8675309") but
> the application requires the number to be provided in three
> attributes ("country", "area" and "local" parts). It seems that one
> way to do this is to have three separate Attribute Definitions:

If the SP requires three different attributes that's the /only/ way,
of course.

> Is there a better way to do this?

No, as you need to set different attribute names for the wire format.
If you're asking of whether the IdP has some "batch" type feature that
would allow the creation of multiple attributes in one go, than no.

> Again, this is only being used by one SP, and I don't know if I
> should be caring about the efficiency of things like this.

In this case my answer would be clearly no, you shouldn't care about
the overhead of attribute definitions that take existing (i.e.,
already resolved) attributes and making them available under different
names. Even if there's a regex in the telephoneNumber case ;)

If you're serious about this I'd start with gathering empirical data
(unless you already know that your data sources are not
performing/lacking), e.g. on the DEBUG the IdP will tell you every
miniscule detail it spends its time on.
You'll see how much time it spends resolving stuff, transforming it in
your regexes, packaging it up for transfer, signing, etc.
-peter