Using URLs vs. URN OIDs: best practice?

[Klingenstein, Nate]

Adam,

My strong preference is to define attribute names as URL's if you control them.  A URL for an attribute could be resolved into helpful information describing what the attribute is and what it should be used for, even in human terms and someday a schema.

URL ownership is also way more obvious to the average recipient.

The main advantages of URI's is their opacity, which was a great way to table any and all argument about where and how attributes should be defined.

If these are your attributes, it's a no-brainer to me, no matter where the attributes originally came from.  You can do so, so much more with a URL.

Take care and I hope you and the team are well,
Nate.

p.s. SAML as a specification does say that attributes that live in LDAP use OID's with SAML.  I would absolutely not follow that guidance, and I don't think there's a lot of SAML deployers that do today.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of shibboleth655 at lewenberg.com
Sent: Monday, April 23, 2018 11:04 AM
To: Shib Users <users at shibboleth.net>
Subject: Using URLs vs. URN OIDs: best practice?

Our IdP releases several institution-specific attributes with names that are not URI's, e.g., "workAddress" and "departmentalAffiliation".

We are working on changing this. Several of these attributes come from our LDAP and, since we have our own LDAP OID namespace, have globally unique OIDs.

We are considering two options for the new names:

1. Use our OID, as in "urn:oid:1.x.x.x.x.x.x"

2. Use a globally unique URL, such as
"https://attribute.our.domain.net/saml/workAddress".

The second format has a couple of obvious examples: it is easier to see from the name what the attribute is and, as the name is a URL, we can set it up so that going to that URL displays the documentation on that attribute.

In fact, Internet2 encourages this (see https://www.internet2.edu/products-services/trust-identity/mace-registries/#service-faq
)

Before embarking on this large change, I wanted to know if there are any advantages to using the "urn:oid" over the URL? Remember, that right now for several of our attributes we are using _neither_.

Thanks you, Adam Lewenberg



--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net