Practical purpose of SAMLnScopedString

[Eric Goodman]

So this is, I think, a very basic (and probably not operationally important) question:

What is the practical value of having a SAML type of SAMLnScopedString?

We noticed that one of our IdPs is resolving ePPN as an unscoped attribute, and we wanted to fix that. Then we realized: "hey, why isn't this already broken?" At least one of our IdPs that resolves ePPN as a scoped string still expresses the attribute in assertions as an xsd:string with no formal Scope element.

The delivered attribute-policy file on the Shib SP defines a ScopingRules that disallows "@" in the attribute value. The delivered attribute-map file invokes the ScopedAttributeDecoder. I can only assume that the ScopedAttributeDecoder is basically splitting all flat string values into scoped attributes prior to applying the policy. FWIW, nothing in the formal definition of ePPN appears to declare it formally as a SAML Scoped String either, it's just defined as a string that it is composed of a value and a scope separated by an "@".

So if the scoped attributes are generally expressed as strings with implicit rules, and even the Shib IdP puts them (in at least some cases) on the wire without a specified scope, what's the practical purpose of defining the attribute as SAML2ScopedString vs just calling it a string?

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160720/fce37fe7/attachment.html>