Attribute namespaces

[Peter Schober]

* Phillip Grandsard <pgrandsard at pagepath.com> [2021-02-15 20:38]:
> Our IdP's typically use mace, oasis, or oid attribute namespaces but some
> want to send undecorated such as:
> 
>             <saml:Attribute Name="mail"
> 
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
>                 <saml:AttributeValue xmlns:xs="
> http://www.w3.org/2001/XMLSchema"
>                                      xsi:type="xs:string">
> foo at bar.com</saml:AttributeValue>
>             </saml:Attribute>
> 
> is this acceptable?

It's a bad idea. (It doesn't scale. Consider everyobody making up
their own name for the same data, e.g. "name", "Name", "full_name",
"fullName", "FullName", etc. and worse, even attach slightly
different, possibly mutually exclusive, ad-hoc semantic or syntactical
requirements on that data).
With the "basic" name format it's spec-legal, though.

So depending on what you mean with "acceptable" it either is (spec
legal) or isn't (a good idea).

-peter