Question about best practice regarding release of deprecated encodings

[Andrew Morgan]

On Tue, 10 Nov 2015, Bellina, Brendan wrote:

> My understanding is that the resolver is not SP specific, so you define
> each encoder you need within it.  An example of one demonstrating what I
> am talking about would have encoder lines like so:
>
> <resolver:AttributeEncoder xsi:type="SAML1String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                        name="urn:mace:dir:attribute-def:sn" />
> <resolver:AttributeEncoder xsi:type="SAML2String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                        name="urn:oid:2.5.4.4" friendlyName="sn" />
> <resolver:AttributeEncoder xsi:type="SAML2String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                        name="urn:mace:dir:attribute-def:sn"
> friendlyName="sn" />
>
> In this case a SAML2 SP is going to get duplicated values of sn if it
> accepts both of the SAML2String encodings defined, which it may want to do
> because it has one IdP giving it OID and another giving it URN. I am
> asking if there is a way in the attribute release policy to indicate that
> for a specific SP I only want to use one of the SAML2String encodings, not
> both of them?

That's a mis-configured IDP, right?

If you really must release something incorrect to a specific SP, create 
two attributes:

     <!-- normal surname attribute -->
     <resolver:AttributeDefinition xsi:type="ad:Simple" id="surname" sourceAttributeID="sn">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" />
     </resolver:AttributeDefinition>

     <!-- broken surname attribute for silly SP -->
     <resolver:AttributeDefinition xsi:type="ad:Simple" id="sillySPsurname" sourceAttributeID="sn">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:mace:dir:attribute-def:sn" friendlyName="sn" />
     </resolver:AttributeDefinition>

Then change your attribute filter to only release sillySPsurname to the 
specific SP.

 	Andy