SAML2 attribute names breaking standards

[Wessel, Keith]

A fair point, Mike. But that's the smaller issue here. While it'd be great if the vendor was using a standard attribute, we can argue them using their own attribute. They explained to me that different institutions (presumably not all higher-ed) have wanted to use different things for an external ID. If that's the case, they can at least use a standard naming convention (urn:oid:...) for their custom attribute. It's one thing to make up your own attribute, but another to break the SAML standard.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Michael A Grady
Sent: Friday, November 22, 2013 2:54 PM
To: Shib Users
Subject: Re: SAML2 attribute names breaking standards

And I'm going to be slightly contentious, because I also work a fair amount on the side of the vendors/cloud service providers, and say that until the latest draft of eduPerson is official, eduPerson is missing a key defined identifier -- eduPersonUniqueID. Without that, there are use cases where neither ePPN or eduPersonTargetedID are sufficient. Once that exists, you have a stronger argument.

On Nov 22, 2013, at 1:15 PM, Mark K. Miller wrote:

> 
> On Fri, 22 Nov 2013, Cantor, Scott wrote:
> 
>> On 11/22/13, 10:50 AM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>>> 
>>> I'm sure this breaks some accepted standards out there. Other than 
>>> that, is there a technical reason I shouldn't do this?
>> 
>> Pretty much the reason is that every step you take in this direction 
>> is a burden your configuration will carry. Eventually the weight of 
>> all the hacks just causes a lot of problems in maintaining a working system.
> 
> Also, every time someone allows a step in this direction it just adds 
> to the burden for the next guy that comes along and doesn't want to allow it.
> 
> "But gee, Max, why are you so mean?  We did it this way before with 
> 'Previous' State U. and it works there.  We must be doing it the right 
> way if it already works there."
> 
> Thanks,
> 
> Max
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net