Multiple Attribute Encoders

[Cantor, Scott]

On 12/18/14, 4:12 PM, "Alex Olson" <ako at byu.edu> wrote:
>
>What would happen if I were to have multiple attribute encoders of the 
>same type for one attribute, i.e.
><resolver:AttributeEncoder xsi:type="enc:SAML2String" 
>name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
><resolver:AttributeEncoder xsi:type="enc:SAML2String" name=“email" 
>friendlyName="mail" />

It will end up in the assertion twice, one by each name. The above is 
inappropriate though, you're setting the name to a non-URI but not 
overriding the default nameFormat to something other than the "URI" SAML 
constant.

>When I release “mail” to an SP and it’s a SAML2 request, and they require 
>the released attribute to be named “email”, would this work?

Most SPs not following the standard are buggy throughout, so I imagine it 
will work, but it's still incorrect. If you have to use a made up name, 
set the encoder's nameFormat to
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"

What you should do in any case is tell them to stop requiring a 
non-standard attribute name. Every IdP that tolerates it just perpetuates 
the problems. We all have to stand up. They're the vendor, we're the 
customer.

-- Scott