Question about best practice regarding release of deprecated encodings

[Cantor, Scott]

On 11/10/15, 3:25 PM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:

>* Bellina, Brendan <bbellina at ucla.edu> [2015-11-10 21:03]:
>> If the above is a reasonable approach, then would custom attributes be
>> used, one for each encoding, or is there a way in the release rule to
>> restrict release to a specific encoding so as to avoid duplicates?
>
>The IDP already handles that case in the examples shipped with the
>software, e.g.:
>
>   <resolver:AttributeDefinition id="givenName" xsi:type="ad:Simple" sourceAttributeID="givenName">
>     <resolver:Dependency ref="myLDAP" />
>     <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
>     <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
>   </resolver:AttributeDefinition>

Right, you would literally have to deliberately (and for reasons that I can't imagine) add two more encoders that reversed the protocol/name association.

There's no scenario I can imagine for which that "fixes" a problem. If the SP doesn't support SAML 2 correctly (which happens), so be it. You don't break your IdP to accomodate it. There's no reason to.

-- Scott