skipping duplicate Attribute mapping (same name and nameFormat)

[Andy Bennett]

Hi,

> Stop supporting targeted ID,

...this is one of the things that I'm trying to do.

> ...that would be my suggestion. Enable the
> special decoder we provided to turn that into the proper syntax that
> should be used in all cases, and use that as the required form that you're
> keying off. That was the point of adding it.

I can change <base-64>@scope keys in our shadow accounts to <base-64>
and then say "use persistent-id" rather than "use targeted-id" for that
IDP. However, it doesn't work in general because some IDPs send
differently salted base-64 in targeted-id and persistent-id (see below).
Therefore I need a way to select a specific attribute per IDP as ending
up with a multi-valued persistent-id with non equivalent values, in an
arbitrary and undefined order is not useful.


> You're not recognizing that the decoding and serialization of the broken
> "targeted-id" form is what makes it look "different".

That's not what I meant by "different".

I see targeted-id values of <base64>@scope. Fair enough.

I see persistent-id values of SP!IDP!<base-64> and SP!IDP!<base-64>@scope.

Given a single response from a single IDP which contains multi-valued
persistent-ids and targeted-ids I see different base 64 values in
different values as some IDPs have more than one salt active for
different encoders on their side.

In the "sends single values targeted-id and tri-valued persistent-id,
last persistent-id matches targeted-id, first and second persistent-
ids match each other but don't match targeted-id" case in my original
mail, I see

targeted-id = "X at scope"
persistent-id = "SP!IDP!Y;SP!IDP!Y;SP!IDPX at scope"

I also see things like

targeted-id = "Z at scope"
persistent-id = "SP!IDP!Z;SP!IDP!Z at scope"

and

targeted-id = "W at scope"
persistent-id = "SP!IDP!W;SP!IDP!W"



In transaction.log I see attribute decode lines such as

persistent-id (1 value)
persistent-id (2 values)
targeted-id (1 value)

...sometimes all in a single transaction.


I've tried talking to IDPs who send more than one base-64 value but when
we worked through the problem they couldn't choose one because they had
some SPs that relied on one and some SPs that relied on the other, the
didn't know who required and they had issues with various services when
they switched one or other off.


...so I have a need to distinguish the values sent inside attributes
with different URIs and a need to choose a particular URI on a per IDP
basis.

We are trying to be "liberal in what we accept" and we have very little
influence over what we are sent due to operational issues on the IDP side.


We're in an inter-federated environment so it's only going to become
more important to be able to deal with these issues on the SP side.





Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/