Skip legacy attributes at SP

[Ian Young]

On 19 Jun 2013, at 10:32, "Achugatla, Vijay K. (ELS-CON)" <vijay.achugatla at lexisnexis.com> wrote:

> Is this the correct way to do it or is there any better way to ignore legacy attributes?

There isn't one correct way to do anything in this area, it all depends on circumstances and what you're trying to do.

If you were SAML 2.0 only, an IdP would be incorrect in sending you the "legacy" attribute, which was defined only for SAML 1.  So, if you were SAML 2.0 only, it would be pretty safe to just ignore it in the way you describe.

If your service supports both SAML 1 and SAML 2.0, though, some of the IdPs your service talks to may still be sending you only the legacy attribute, depending on how old they are.  If that was the case, discarding the legacy attribute would mean you wouldn't be getting an ePTID from them at all and if your service needs such a thing that might be a problem.  You'd have to work with those IdPs to resolve that.

It's much easier to resolve problems like this if (a) you're standing up a new application and (b) you can go SAML 2.0-only.  Unfortunately, we're still in a position where a lot of IdPs can't do SAML 2.0, so that can limit your customer base.

	-- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130619/7dcbed7b/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130619/7dcbed7b/attachment.bin