Attribute encoding - meaning of 'name' with URL

[John Horne]

On Thu, 2014-07-31 at 23:11 +0000, Kevin Foote wrote:
> On Jul 31, 2014, at 3:55 PM, John Horne <john.horne at plymouth.ac.uk>
> wrote:
> 
> > My question though is what is the 'name' used for? 
> > ….
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringAttributeEncoder says that the 'name' is required, but not why.
> 
> 
> I’m sure others on list have far more detailed answers. However for a
> short answer the “name” portion is what the 
> attribute gets transferred as on the wire so to speak.
> 
> So for instance the RP (on the other end) will need to have something
> in their attribute-map.xml file that has that “name” defined to a
> local name.
> 
Okay, and to some extent that's what I ended up thinking. However, the
attribute already has an 'id' defined, so why not use that instead of
requiring the 'name' field as well?

It also seems to confirm though that this (name) is simply something
agreed between the IdP and SP, and in itself may well have no meaning.
That is, I could just as easily have agreed to use the name 'fred',
'xyz' or 'hjhj4343-sasa'. If the IdP sends it, and the SP can map it to
a local attribute, then shibboleth communication between the IdP and SP
should work regardless of the fact that the 'name' is meaningless.

The use of an OID, where available, I assume basically simplifies this
process in that both the IdP and SP use specific OIDs for specific
attributes. That is, if the SP wants the EPPN attribute, then the IdP
sends it with the OID of 1.3.6.1.4.1.5923.1.1.1.6. The SP expects that
OID to be used because it is well-defined for the EPPN attribute.




John.

-- 
----------------------------------------------------
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK