SAML2 attribute names breaking standards

[Michael A Grady]

On Nov 22, 2013, at 2:59 PM, Wessel, Keith wrote:

> A fair point, Mike. But that's the smaller issue here. While it'd be great if the vendor was using a standard attribute, we can argue them using their own attribute. They explained to me that different institutions (presumably not all higher-ed) have wanted to use different things for an external ID. If that's the case, they can at least use a standard naming convention (urn:oid:...) for their custom attribute. It's one thing to make up your own attribute, but another to break the SAML standard.

Yes, totally agree there. Although I consider a URL versus an OID as an acceptable "fall back" position, as:

  https://wiki.shibboleth.net/confluence/display/SHIB2/AttributeNaming

suggests. So OID if one can get it, but if that is a "step too far", suggest a URL name. (I've personally never really liked OIDs that much, regardless of understanding the advantages of such. But I'll still push for OIDs when I can.)


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.