Attribute mapping problem

[Peter Schober]

* Nate Klingenstein <ndk at sudonym.me> [2023-02-09 18:18]:
> There's a mismatch in the NameFormat.  One is expressly basic, and the
> other is defaulting to URI.  You should work with the IdP to agree on what
> you're sending, and since it's a URI, I would recommend URI.

Only URI is correct here, IMO, because this is about an eduPerson
attribute and the authoritative SAML profiles for eduPerson attributes
are the "MACE-Dir SAML Attribute Profiles":
https://shibboleth.net/documents/internet2-mace-dir-saml-attributes-200804.pdf

Section 3 of which refers to the SAML V2.0 LDAP/X.500 Attribute
Profile for attribute naming
https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-attribute-x500.html
which in section 2.3 says:

> The NameFormat XML attribute in <Attribute> elements MUST be
> urn:oasis:names:tc:SAML:2.0:attrname-format:uri.

So for use with SAML 2.0 I think only
"urn:oid:1.3.6.1.4.1.5923.1.1.1.9" as Attribute/@Name together with
URI as NameFormat would be correct.

-peter