Attribute encoding - meaning of 'name' with URL

[John Horne]

Hello,

Running Shibboleth IdP 2.4.0 we added to our resolver file the following
definition:

=========================================
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="PPID"
sourceAttributeID="extensionAttribute10">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" friendlyName="PPID" />
    </resolver:AttributeDefinition>
=========================================

The PPID, I gather, comes from Microsoft ADFS and looks like a hex
character string (although I thought I read that it was actually
base64?). We spent some time trying to find a defined OID, but there
doesn't seem to be one for PPID - which probably explains why it is
being sent as an LDAP extension attribute. So, we thought we would use
the above URL (xmlsoap.org) on the 'name' part of the encoder (the SP
gave us the URL).

My question though is what is the 'name' used for? The above URL exists
but provides no information. I have seen other cases (on other IdP's)
where a URL has been used which doesn't even exist (gives a 404 error),
yet shibboleth (to and from the IdP and SP) works fine. If, as it seems,
anything could be put into the 'name' URL, then what is the point of
requiring it at all?

https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringAttributeEncoder says that the 'name' is required, but not why.

The following
https://wiki.shibboleth.net/confluence/display/SHIB2/AttributeNaming
says that the URL 'should resolve into documentation, providing helpful
information for unwitting relying parties' :-) I'm not sure what helpful
information would be expected except perhaps some description of the
attribute being sent? Regardless, it seems to imply that if there is no
such information, or even if the URL doesn't exist, then this makes no
difference to shibboleth working between the IdP and SP.




Thanks,

John.

-- 
----------------------------------------------------
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK