Attribute namespaces

[Phillip Grandsard]

They are claiming this is the standard way the metadata is being sent from
Oracle. I don't know how assertions are set up in Oracle to know to tell
them what, if anything, to change. Anyone familiar with an Oracle IdP?

On Mon, Feb 15, 2021 at 3:23 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Phillip Grandsard <pgrandsard at pagepath.com> [2021-02-15 20:38]:
> > Our IdP's typically use mace, oasis, or oid attribute namespaces but some
> > want to send undecorated such as:
> >
> >             <saml:Attribute Name="mail"
> >
> > NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
> >                 <saml:AttributeValue xmlns:xs="
> > http://www.w3.org/2001/XMLSchema"
> >                                      xsi:type="xs:string">
> > foo at bar.com</saml:AttributeValue>
> >             </saml:Attribute>
> >
> > is this acceptable?
>
> It's a bad idea. (It doesn't scale. Consider everyobody making up
> their own name for the same data, e.g. "name", "Name", "full_name",
> "fullName", "FullName", etc. and worse, even attach slightly
> different, possibly mutually exclusive, ad-hoc semantic or syntactical
> requirements on that data).
> With the "basic" name format it's spec-legal, though.
>
> So depending on what you mean with "acceptable" it either is (spec
> legal) or isn't (a good idea).
>
> -peter
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Phil Grandsard | Senior Software Engineer
phil.grandsard at printreach.com | 1-630-332-0378
Print Reach Software, LLC | www.printreach.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210217/851e188a/attachment.htm>