Attribute definition type for eduPersonTargetedID?

[Cantor, Scott]

On 7/26/21, 11:27 AM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Per Scott’s comment about <requestedAttribute>, I don’t know how widely used it is, but I know that we’re > not the only school that releases requested attributes to InCommon participants.

The fact that everybody is using information I know isn't accurate doesn't change that it's not accurate, I'm afraid. It *can't* be accurate for the reasons covered ad nauseum. If you require A or B, you can't signal that, and a huge number of SPs are in that situation.

> If we drop the eptid attribute definition, and since InCommon doesn’t support an SP being able to signal their
> preferred name ID format in metadata, it sounds like we’re going to be breaking some things.

You should know who you're releasing something to and also what SPs you "support" vs. SPs that might work but aren't really something you can be expected to guarantee will work. It's a matter of testing them. I do that sort of thing all the time when I change things that are supposed to be compatible.

> Maybe the answer here is support for requested name ID format in InCommon metadata.

It's been explored. It's unworkable (in or out of InCommon) because the format almost always is "whatever the IdP wants to send, we don't care" and it also varies by IdP. It doesn't work in shared metadata, only bilateral (in which it's a convenience and generally maintained by the IdP anyway).

This is why the entire collossal mess was deprecated. It's far too broken to fix it at this point. Every decision and guess I made at every step over 20 odd years was essentially as wrong as possible.

-- Scott