SAML2StringEncoder Name for RelationalDatbase Attribute

Peter Schober peter.schober at univie.ac.at
Tue Mar 15 17:24:09 EDT 2016


* Peter Schober <peter.schober at univie.ac.at> [2016-03-15 22:14]:
> Once you have those in the attribute definition you can assign any
> encoder you want to that, including something completely unrelated to
> where it came from. That decides the on-the-wire representation of the
> data structure, not more and not less.

If you're question was "How do I assign/make up good names (URIs) for
data structures where the underlying technology doesn't provide any
obvious ones?"
then it's probably best you forgot about the underlying data source
and only looked at the data's syntax and semantics:
E.g. a person's name is still a name, no matter where it came from.
And X.500 or LDAP or eduPerson or SCHAC will often have a unique
attribute name defined for that (in all of those cases it will have an
OID assigned, which becomes a urn:oid -based URI), which is how you'd
communicate that to relying parties.

If all else fails creating unique URI-based names could be done by
registering (or requesting delegation) of a namespace, whether that
were a DNS domain, a URN NSS, an OID from IANA (and a urn:oid based on
that) etc.
Often you won't be alone in deciding how to name those attributes,
your circle of trust you intend to share that data with may have an
interest in agreeing on those names/nameformats.

Now that I've typed all this I realise there must be something on that
matter already. Of course there is:
https://wiki.shibboleth.net/confluence/display/SHIB2/AttributeNaming
-peter


More information about the users mailing list