Is this a metadata error?

[David Gersic]

>>> On 5/24/2013 at 02:14 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote: 
>>  which I *think* means that I'm releasing these attributes to any SP defined 
> in
>> the InCommon metadata. I release ePPN to anybody.
> 
> But are you actually creating and supporting eduPersonPrimaryAffiliation in 
> your resolver?

Yes.

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="eduPersonPrimaryAffiliation" sourceAttributeID="edu
PersonPrimaryAffiliation">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:eduPersonPrimar
yAffiliation" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" friendly
Name="eduPersonPrimaryAffiliation" />
    </resolver:AttributeDefinition>

Sorry, I should have included that too.


>> If I'm reading this correctly, the SP defined in the metadata expects to get 
> cn,
>> eduPersonAffiliation, and mail. It doesn't mention
>> eduPersonPrimaryAffiliation, so it doesn't get ePPA, which is why it can't
>> display ePPA at the test page.
> 
> It may be incompete but it has nothing to do with your attribute release 
> unless you're deploying the filter plugin that uses that metadata (your 
> example did not).

Hm. I'll have to plead ignorance here. I don't know if I have, or not, and I don't know where to look. Where would a filter plugin be deployed or defined?


> Personally, I think no vendor should use that attribute anyway. The concept 
> of  "primary" is pretty meaningless and is best avoided IMHO. It might make 
> sense for searching, but not authorization.

Hm. Reading the definition in eduPerson, it made sense to me to define ePPA as being the best available value of eduPersonAffiliation. For this SP, it seems to be a good match for what they're trying to do.

What they need is an indication that the authenticated person is a "student" or "employee". These are mutually exclusive in their system. ePA is multivalued, and a person could be both "student" and "employee" here. By populating ePPA with the "best" single value of ePA, it seemed to me that having this vendor use ePPA would meet their needs in a way that made the most sense.

Looking at the InCommon metadata, it looks like I'm not the only one trying to do something like this with this vendor, other sites are using eduPersonScopedAffiliation, probably for the same reason. I'm not seeing a big difference between an ePPA of "student" vs. an ePSA of "student at niu.edu" really.

Is there a better way to solve this problem? What would you use if not ePPA?