Changing the format of attributes sent to the SP .

[Peter Schober]

* Kobi Seviliya <kobi at outbrain.com> [2014-07-16 19:06]:
> i currently have an LDAP attribute defined like this sent to the SP .
> 
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="firstname"
> sourceAttributeID="givenName">
>         <resolver:Dependency ref="MYLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:givenName" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:2.5.4.42" friendlyName="firstname" />
>     </resolver:AttributeDefinition>
> 
> 
> and the way it shows in a SAML trace is this :
> 
> <saml2:Attribute FriendlyName="lastname"
>                              Name="urn:oid:2.5.4.4"
> 
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>                              >
>                 <saml2:AttributeValue
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                                       xsi:type="xs:string"
>                                       >*John*</saml2:AttributeValue>

In fact no, because above you defined "urn:oid:2.5.4.42" in you IDP
but below you showed "urn:oid:2.5.4.4" at your SP, so two different
attributes.
Maybe you just copied from the wrong attribute definition.

> Now, the problem is that the SP requires me to send the attribute at this
> format :
> 
> *name=john *
> 
> can i force the attribute to be sent in that format ?

While the Shibboleth IDP certainly allows you to do that (and you
don't need a Script attribute definition, a Mapped one with a regex
will do just fine), appending the same fixed string to all values
obviously does not add information for the SP and so in theory could
be done by the SP just as well.
More disturbingly an SP that requires to prefix the attriute value
with some kind of type of the attribute (i.e., as part of the value)
seems to have deeper running problems with actually understanding
which attribute it is being sent.
You don't need attribute values to tell you what kind of attribute it
is ("email=foo at example.org"), the SAML will tell you the exact,
globally unique and clearly specified attribute name (for URI naming
at least), the format the name is in (e.g. URI or "basic" attribute
names) and the value, all in seperate XML data structures. The value
of the attribute (i.e., "foo at example.org") should be just that, the value.
So the SP should look at the Attribute/@Name to find out what it is.

With either interpretation (useless static prefix; SP trying to find
out the attribute name/type from the value) I'd say that SP Is Doing
It Wrong. If I could afford it I wouldn't comply with that request.
-peter