Question about available attributes

[Christopher Bongaarts]

On 6/11/2014 11:27 AM, Kevin Foote wrote:
> On Jun 11, 2014, at 9:20 AM, Ken Weiss
>> <ken.weiss at ucop.edu>  wrote:
>>
>> >Is there a set of attributes that every single Shibboleth IDP is required to release to every configured SP? At the very least, will a successful authentication result in the EPPN being returned to the SP?
> No such set. An IdP is free to send all, some or none of the attributes it obtains for the principal it has authenticated.
> You can plan on getting a statement back I guess.

You might not get an attribute assertion if the IdP doesn't release any 
attributes.

You should get an authentication assertion which should contain a 
Subject with a NameID.  That's about the only thing you can rely on 
being present 99.99% of the time.  For Shib IdPs the usual default is to 
release a transient ID in the NameID.

Applications should be prepared to act appropriately when they don't get 
some or all of the attributes they were expecting, hopefully providing a 
somewhat meaningful error message ("your school is not set up to tell us 
your SSN, so you can't use this app.")  I think this is where the 
errorURL in an IdPs metadata would be useful, to direct the user 
someplace they can get fixed.  Or continuing on if only optional 
attributes were omitted.

You can help by published the attributes your app wants/expects in your 
SP metadata.  This gives IdPs an opportunity to handle the situation 
proactively (though most don't, yet).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%