<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Tue, 5 Mar 2013, at 11:53 , "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 3/5/13 3:18 PM, "David Bantz" <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br><br><blockquote type="cite">Is it appropriate to resolve and release the bare directory attributes<br>(as opposed to tidying them up in some way as suggested in<br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttribu">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttribu</a><br>teDefinitionExamples)?<br></blockquote><br>What tidying is it suggesting?<br></blockquote><div><br></div>Scripts on that page appear to build [ePA] attribute values from a piece of the group membership directory attribute;</div><div>so localizing, from the (real) AD memberOf value CN=SW_Employees,OU=Groups,OU=SW,DC=ua,DC=ad,DC=alaska,DC=edu</div><div>add the value SW_Employees to a local uakaffiliation attribute. </div><div><br></div><div>I would prefer not to do that and keep the SAML attributes directly reflecting the values in directories, but I can see service</div><div>owner preferring the shorter values.</div><div><br></div><div><br><blockquote type="cite"><blockquote type="cite">Is it appropriate to keep these in separate attributes for release<br>(rather than combining them)?<br></blockquote><br>It seems like a questionable idea to me, but YMMV.<br><br></blockquote><blockquote type="cite"><font color="#007316">….</font>All in all, it seems like a bad idea vs. just using isMemberOf or whatever<br>is in eduPerson. For SAML purposes, why perpetuate all the weird history<br>of group membership attributes vs. just picking one that exists and going<br>with it?</blockquote><br></div><div>As I indicated, that was a service owner request; it's a knowledgeable and reasonable</div><div>service owner for once, so that choice is presumably open to revision based on </div><div>good reasons. </div><div><br></div><div>Locally, people do strongly distinguish our Domain AD directory from the Oracle DSEE</div><div>and use them differently (let's not get into tribal warfare here) so it is not surprising to</div><div>me to have a service owner think of these as "different" as that reflects local practice.</div><div><br></div><div>Can you elaborate on why is seems questionable or a bad idea?</div><div>We will both (the service owner and I) appreciate your thoughts.</div><div><br></div><div>Thanks,</div><div><br></div><div>David</div><br></body></html>