Attribute encoding - meaning of 'name' with URL

[Cantor, Scott]

On 7/31/14, 6:55 PM, "John Horne" <john.horne at plymouth.ac.uk> wrote:
>
>The PPID, I gather, comes from Microsoft ADFS and looks like a hex
>character string (although I thought I read that it was actually
>base64?). We spent some time trying to find a defined OID, but there
>doesn't seem to be one for PPID - which probably explains why it is
>being sent as an LDAP extension attribute. So, we thought we would use
>the above URL (xmlsoap.org) on the 'name' part of the encoder (the SP
>gave us the URL).

The name is what it is. You don't guess, it's part of the attribute's
definition. If you don't have a name to use, you don't have a technically
precise definition of a SAML attribute, usually because one or more
parties doesn't know enough to create it.

LDAP uses OIDs, SAML uses strings that should be but don't have to be URIs.

>My question though is what is the 'name' used for?

To unambiguously identify the attribute.

> The above URL exists
>but provides no information. I have seen other cases (on other IdP's)
>where a URL has been used which doesn't even exist (gives a 404 error),
>yet shibboleth (to and from the IdP and SP) works fine. If, as it seems,
>anything could be put into the 'name' URL, then what is the point of
>requiring it at all?

URIs used as identifiers are a very common and widespread practice in XML,
because they're globally unique with pre-existing authority delegation
mechanism (DNS and the URN registration mechanism).

URI names don't have to resolve to be names. The string is the name, by
itself.

>https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringAttributeE
>ncoder says that the 'name' is required, but not why.

A SAML attribute encoder generates a SAML Attribute element. A SAML
Attribute element requires a Name attribute in XML. Ergo, the
configuration of the encoder requires it.

>The following
>https://wiki.shibboleth.net/confluence/display/SHIB2/AttributeNaming
>says that the URL 'should resolve into documentation, providing helpful
>information for unwitting relying parties'

I reworded it.

-- Scott