SAML2 attribute names breaking standards

[Michael A Grady]

And I'm going to be slightly contentious, because I also work a fair amount on the side of the vendors/cloud service providers, and say that until the latest draft of eduPerson is official, eduPerson is missing a key defined identifier -- eduPersonUniqueID. Without that, there are use cases where neither ePPN or eduPersonTargetedID are sufficient. Once that exists, you have a stronger argument.

On Nov 22, 2013, at 1:15 PM, Mark K. Miller wrote:

> 
> On Fri, 22 Nov 2013, Cantor, Scott wrote:
> 
>> On 11/22/13, 10:50 AM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>>> 
>>> I'm sure this breaks some accepted standards out there. Other than that,
>>> is there a technical reason I shouldn't do this?
>> 
>> Pretty much the reason is that every step you take in this direction is a
>> burden your configuration will carry. Eventually the weight of all the
>> hacks just causes a lot of problems in maintaining a working system.
> 
> Also, every time someone allows a step in this direction it just adds to 
> the burden for the next guy that comes along and doesn't want to allow it.
> 
> "But gee, Max, why are you so mean?  We did it this way before with 
> 'Previous' State U. and it works there.  We must be doing it the right way 
> if it already works there."
> 
> Thanks,
> 
> Max
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.