Attribute Definition and SAML2String Attribute Encoder type

[Peter Schober]

* Michael Dahlberg <olgamirth at gmail.com> [2016-11-15 19:45]:
> To be honest, when working with the Shib config files, I've tried to
> find a relevant example of an AttributeDefinition and
> AttributeEncoder copy it and make small changes, often without
> really understanding the definitions and changes I was making.  I
> now need to write one from scratch, sort of.

You can still start with a copy from any of the existing ones, to get
at least the structure right the first time.

> (1) Does the name have to be an oid?  If so, since this is a brand new
> attribute, can I just make-up the value?

https://wiki.shibboleth.net/confluence/display/SHIB2/AttributeNaming
gives the recommendations and the reasons for those, so not point in
repeating them here.

> (2) If I have a static connector that defines two different
>     attributes, abcSchoolNumber and xyzSchoolNumber, can I have a
>     single Attribute Definition, SchoolNumber, that releases one or
>     the other based on different entityIDs?

There are two separate things to consider here: "internal" (to the
IDP) attribute names are assigned in an AttributeDefintion and
referenced in the attribute filter to decide which attributes to
release where. "External" names would be the formal names you'd set in
an AttributeEncoder/@name. You can mix and match those at will,
e.g. by creating two attribute defintions, each with its own id, and
release them in two separate filter rules. Those could have the same
formal attribute name on the wire (from the encoder), or they could
differ.

In current IDP releases you also have more flexible methods
(activation conditions), but flexibilty always comes with complexity,
and I'd stick with attribute definitions and matching filter rules,
for now.

-peter