Releasing the same attribute with different friendly names?

[Morgan, Andrew J]

There are definitely cases where the SP cares about the friendlyName, unfortunately.  I can't think of any reason why a single SP would need both attributes though.  Just pick the right one and release only it.

Andy
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: Monday, January 23, 2023 1:01 PM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>; Rob Ansaldo <ransaldo at smith.edu>
Subject: Re: Releasing the same attribute with different friendly names?

[This email originated from outside of OSU. Use caution with links and attachments.]

> ln my attribute-resolver, both lastname and sn come from the same LDAP
> attribute and both have a name defined as "urn:oid:2.5.4.4", but have different
> friendly names.

That isn't supported. It's only working by accident, a bug was fixed to prevent it from creating separate SAML Attributes with the same name anyway and that isn't getting "unfixed". It should have been doing that all along.

> Can anyone think of why this would be necessary? Is there a case where the SP
> cares what the friendlyname is?

Are there such SPs? Yes. That doesn't make it something you should tolerate, and practically speaking we made it impossible to do what you're doing, so...that's just how it is. It was fixed in 4.2.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C00052272468840dddd9508dafd85022f%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638101044952665892%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Ieet%2FJVkjv5OTMB9HE2qaHzn2Xp%2FkwohEZ5Ca048EU8%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230123/1217f2ad/attachment.htm>