Question about best practice regarding release of deprecated encodings

[Bellina, Brendan]

Thanks.

If I am understanding correctly then it sounds like the best course would
be for SP¹s to be configured to accept all encodings and the IdP use an SP
specific attribute release policy to only release one.  The only
coordination required is that the SP¹s would have to make their change
first, but once done the IdP change could be made at any time afterward
with no risk of impact.

If the above is a reasonable approach, then would custom attributes be
used, one for each encoding, or is there a way in the release rule to
restrict release to a specific encoding so as to avoid duplicates?

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA



On 11/10/15, 11:30 AM, "users on behalf of Cantor, Scott"
<users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>Also, no, using the attribute filter in the SP doesn't really work to
>eliminate duplicates because you'd have to map them into separate headers
>(which means the duplicates aren't really duplicates anymore). Filter
>rules are based on the name you map the attribute into, not the name on
>the wire.
>
>There is no way, full stop, to control the encodings you support by IdP
>without misusing a bunch of complex features in a way that would be
>ludicrous to consider. It's just not how the SP was designed because I
>did not anticipate anybody would choose to name attributes subjectively,
>and the cost of doing so wasn't really significant (duplicates or
>separate mappings).
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net