Using Metadata in my App

[Andy Bennett]

Hi,

> It's whatever you choose to serialize it into with the software via the
> decoder rule. The underlying data is a SAML NameID element in XML with a
> three part structure, value, SP qualifier, and IdP qualifier.
> 
> The first thing you probably need to do is read this:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID
> 
> That explains why there are different syntaxes floating around this and
> what "targeted-id" is (a legacy name for a broken syntax that was
> accidentally adopted).

Ah yes. I remember reading that way back at the beginning when I knew
even less than I do now. ;-) It was worth another read tho'. Thanks.

I set up the decoders thusly in attribute-map.xml:

-----
    <!-- First, the deprecated/incorrect version, decoded as a scoped
string: -->
    <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
id="targeted-id">
        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
        <!-- <AttributeDecoder
xsi:type="NameIDFromScopedAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defau
ltQualifiers="true"/> -->
    </Attribute>

    <!-- Second, an alternate decoder that will decode the incorrect
form into the newer form. -->
    <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
id="persistent-id">
        <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQua
lifiers="true"/>
    </Attribute>

    <!-- Third, the new version (note the OID-style name): -->
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="t
rue"/>
    </Attribute>

    <!-- Fourth, the SAML 2.0 NameID Format: -->
    <Attribute
name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
id="persistent-id">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="t
rue"/>
    </Attribute>
-----

...and I still seem to get some IdPs who's auth comes thru with old
style targeted-id and no persistent-id. I wanted to get both variables
when IdPs were sending the old style and I was transforming it into the
new style in the SP. The intention was to assert that the value parts
were equal and then migrate.



> That's a perfectly fine thing to want, but neither the entityID nor
> anything that's in SAML metadata is an organizational identifier. The
> history of such things is that we have no standard for such a thing,
> because every application tends to have its own views of what it's trying
> to identify. There are many, many schemas for identifying organizations,
> but they don't span applications.
> 
> I think, personally, that federation creates an opportunity for revisiting
> that question because so many different applications rely on this common
> infrastructure. But we haven't done it, and even if we did, no other
> verticals would probably follow us, which puts the SPs in the same
> situation, no common standard.

Thanks for the tips. It looks like there are lengths that I can go to
that will allow me to reap some benefit from the data in my particular
Federation but there are no Silver Bullets.



Thanks!





Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/