group memberships from two sources

[Christopher Bongaarts]

On 3/5/2013 3:53 PM, David Bantz wrote:
> Scripts on that page appear to build [ePA] attribute values from a piece
> of the group membership directory attribute;
> so localizing, from the (real) AD memberOf
> value CN=SW_Employees,OU=Groups,OU=SW,DC=ua,DC=ad,DC=alaska,DC=edu
> add the value SW_Employees to a local uakaffiliation attribute.
>
> I would prefer not to do that and keep the SAML attributes directly
> reflecting the values in directories, but I can see service
> owner preferring the shorter values.

One advantage of using the full group DNs is that an LDAP-enabled 
application can (given proper authorization) turn around and look up a 
user's group in a directory to get things like a CN/displayName for the 
group, other group members, etc.

The disadvantage is what you mention - an app that isn't LDAP enabled 
that tries to display the group name will confuse normal humans.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%