Question about available attributes

[Curry, Warren]

+1

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Wednesday, June 11, 2014 1:00 PM
To: users at shibboleth.net
Subject: Re: Question about available attributes

On 6/11/2014 11:27 AM, Kevin Foote wrote:
> On Jun 11, 2014, at 9:20 AM, Ken Weiss
>> <ken.weiss at ucop.edu>  wrote:
>>
>> >Is there a set of attributes that every single Shibboleth IDP is required to release to every configured SP? At the very least, will a successful authentication result in the EPPN being returned to the SP?
> No such set. An IdP is free to send all, some or none of the attributes it obtains for the principal it has authenticated.
> You can plan on getting a statement back I guess.

You might not get an attribute assertion if the IdP doesn't release any attributes.

You should get an authentication assertion which should contain a Subject with a NameID.  That's about the only thing you can rely on being present 99.99% of the time.  For Shib IdPs the usual default is to release a transient ID in the NameID.

Applications should be prepared to act appropriately when they don't get some or all of the attributes they were expecting, hopefully providing a somewhat meaningful error message ("your school is not set up to tell us your SSN, so you can't use this app.")  I think this is where the errorURL in an IdPs metadata would be useful, to direct the user someplace they can get fixed.  Or continuing on if only optional attributes were omitted.

You can help by published the attributes your app wants/expects in your SP metadata.  This gives IdPs an opportunity to handle the situation proactively (though most don't, yet).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net