change definition of uid name and friendlyname

[IAM David Bantz]

+1

On Thu, Feb 23, 2017 at 10:13 AM, Domingues, Michael D <
michael-domingues at uiowa.edu> wrote:

> If at all possible, I'd strongly suggest to the vendor that what they're
> doing is horribly backwards.
>
>
> That said, in situations such as these if I have no other choice, my
> approach has been to create a separate AttributeDefinition entry (with an
> id like "uid_SillyVendorNameHere") from the same source attribute, with
> whatever non-standard tweaks they vehemently insist upon, and release that
> to them instead.
>
>
> You absolutely won't want to change your working definition.
>
>
> Michael
> ------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of XiaoXia Dong <
> x-dong at northwestern.edu>
> *Sent:* Thursday, February 23, 2017 1:09:59 PM
> *To:* Shib Users
> *Cc:* Phil Tracy
> *Subject:* change definition of uid name and friendlyname
>
>
> Hello Shib Experts,
>
>
>
> We have a vendor which does not work with the out of box definition of uid,
>
>
>
> Here is the original one:
>
>
>
>    <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
> sourceAttributeID="uid">
>
>         <resolver:Dependency ref="myLDAP" />
>
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:uid" />
>
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
>
>     </resolver:AttributeDefinition>
>
>
>
>
>
> In order to make this particular app work, I need to swap the name and
> friendlyName of uid,
>
>
>
>  <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
> sourceAttributeID="uid">
>
>         <resolver:Dependency ref="myLDAP" />
>
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:uid" />
>
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid"
> friendlyName="urn:oid:0.9.2342.19200300.100.1.1" />
>
>     </resolver:AttributeDefinition>
>
>
>
>
>
> I realized that this is a global change and it could potentially break
> some other applications. I like to get opinions from shib experts how risky
> this change is and whether it is a safe change from SAML2.
>
>
>
> Thank you.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170223/559bbf2e/attachment-0001.html>