SAML2 attribute names breaking standards

[Peter Schober]

* Michael A Grady <mgrady at unicon.net> [2013-11-22 22:07]:
> Yes, totally agree there. Although I consider a URL versus an OID as
> an acceptable "fall back" position, as:

Both are URIs, so both are (equally) fine.

> So OID if one can get it

I think even that is going too far. Use OIDs if the attribute is
*already* *defined* with a OID. If you'd need to make up a URI today a URL
is just as fine.
No one's particularly obsessed with OIDs as such, that was just the
predominant format used for unique attribute names when practically
all interoperable attribute definitions originated in X.500/LDAP.
The fact that they're ugly and not too human-friendly has helped in
making them very stable, though :) At least I have not heard about
management folks demanding the move from one OID arc to another during
a change of the company name (or split or merger or whatever). I can't
say that about DNS names (and hence most URLs).
-peter