Blackboard Transact, SSO and use of attribute friendly-name

[Mizushima, Marcus]

You can refer them to:

http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf

See Page 30:

"FriendlyName [Optional]

A string that provides a more human-readable form of the attribute's name, which may be useful in cases in which the actual Name is complex or opaque, such as an OID or a UUID. This attribute's value MUST NOT be used as a basis for formally identifying SAML attributes."

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Schwoerer, Bradley J
Sent: Thursday, March 13, 2014 11:37 AM
To: Shib Users
Subject: Re: Blackboard Transact, SSO and use of attribute friendly-name

Thank you to Scott, Joel, and Mahmudul.

When on the conference call with Blackboard, I will push for an 'enhancement/bug' fix that will ask them to remove the use of friendly-name.  I am sure it won't go anywhere before we implement, but it is worth asking in the 'before you buy' promises from a vendor.

-Bradley



From: Mahmudul Hasan <cs.mahmud at gmail.com<mailto:cs.mahmud at gmail.com>>
Reply-To: Users Shib <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thursday, March 13, 2014 at 11:11 AM
To: Users Shib <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Blackboard Transact, SSO and use of attribute friendly-name

We have also implemented Shibboleth with Blackboard Transact in University of Lethbridge.

Our configuration is very similar to what Joel Goguen posted above.

- Mahmudul Hasan




On Thu, Mar 13, 2014 at 11:07 AM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 3/13/14, 12:50 PM, "Schwoerer, Bradley J" <schwoerb at uww.edu<mailto:schwoerb at uww.edu>> wrote:

>I was wondering how many people have integrated with Blackboard Transact.
> It seems straight forward, but a bit odd if I am understanding their
>documentation.   According to their documentation they are making use of
>the SAML2 attribute friendly-name.  For people that have implemented 
>this product, is that truly the case.  For others, is that something 
>that other apps are doing?  To me it seems wrong, but wanted to get 
>others perspective.

You don't need to wonder, it's explicitly outlawed in the standard.
FriendlyName is non-normative and is for debugging or UI reasons, etc.

So yes, it's wrong.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net