activation condition in atribute registry?

[Baron Fujimoto]

We're migrating from the older style attribute definitions with their
encodings to the newer attribute registry method and its transcoders.

We have our own version of "mail" because it turns out some SPs don't' deal
well with the potentially multivalued inetOrg mail. Our version was defined
thusly:

    <AttributeDefinition xsi:type="Simple" id="uhEmail">
        <InputDataConnector ref="UH_LDAP" attributeNames="uhEmail"/>
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="uhEmail"
encodeType="false" />
        <!-- SPs that require single-valued mail attribute to be named
"mail" -->
        <!--   conditional predicate defined in activation-condition.xml
   -->
        <AttributeEncoder xsi:type="SAML2String" name="mail"
activationConditionRef="singleValueMailSPs" encodeType="false" />
    </AttributeDefinition>

Our initial dumb translation of this with the attribute registry was:

        <bean parent="shibboleth.TranscodingProperties">
            <property name="properties">
                <props merge="true">
                    <prop key="id">uhEmail</prop>
                    <prop key="transcoder">SAML2StringTranscoder</prop>
                    <prop key="saml2.name
">urn:oid:0.9.2342.19200300.100.1.3</prop>
                    <prop key="saml2.name">uhEmail</prop>
                    <!-- ** add "mail" unconditionally until we know how to
do it more efficiently based only on necessary relyingParties -->
                    <prop key="saml2.name">mail</prop>
                    <prop key="saml2.friendlyName">uhEmail</prop>
                    <prop key="displayName.en">UH Email (guaranteed to be
single-valued)</prop>
                </props>
            </property>
        </bean>

We've already discovered that with the multiple saml2.names, only the last
one appears to be effective. I think ultimately we want to eliminate the
"<prop key="saml2.name">uhEmail</prop>" and just leave the friendlyName for
that.

But is there a way to use an activation condition in the
TranscodingProperties so we can still conditionally provide the name="mail"
alternative? I couldn't find examples of doing so. Or would it be better to
simply define a new attribute and use that where required?

-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220719/d553ec39/attachment.htm>