custom attribute names/formatting

[IAM David Bantz]

A vendor has provided metadata (and oral confirmation) indicating my IdP’s
SAML response include attributes as follows:

...

   <md:AttributeConsumingService isDefault="true" index="0">

      <md:ServiceName xml:lang="en">ASH SAML Service Provider Portal
</md:ServiceName>

      <md:RequestedAttribute NameFormat=
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="UniqueMemberID"
isRequired="True" />

      <md:RequestedAttribute NameFormat=
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MemberSuffix"
isRequired="True" />

      <md:RequestedAttribute NameFormat=
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="Email" isRequired=
"False" />

    </md:AttributeConsumingService>

…


I can add custom attributes like


<!-- UniqueMemberID for HealthRoads SP is employee # = bannerID per UA
Benefits-->

<resolver:AttributeDefinition id="UniqueMemberID" xsi:type="Simple" xmlns=
"urn:mace:shibboleth:2.0:resolver:ad"

sourceAttributeID="BannerID">

        <resolver:Dependency ref="myLDAP" />

        <resolver:AttributeEncoder xsi:type="SAML2String" xmlns=
"urn:mace:shibboleth:2.0:attribute:encoder"

                          name="UniqueMemberID"

                          nameFormat=
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"

                          friendlyName="UniqueMemberID"/>

</resolver:AttributeDefinition>



but should I have concerns other than tidiness of my attribute-resolver and
-filter and precedent for unscalable process of custom named attributes for
every SP?


Is there a better way to deal with needs of this and potential similar
service side requirements?


David Bantz

U Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131224/35f0d5f3/attachment.html