<div dir="ltr">







<p class="">A vendor has provided metadata (and oral confirmation) indicating my IdP’s SAML response include attributes as follows:</p>
<p class="">...</p>
<p class=""><span class="">   </span>&lt;md:AttributeConsumingService <span class="">isDefault=</span><span class="">&quot;true&quot;</span> <span class="">index=</span><span class="">&quot;0&quot;</span>&gt;</p>
<p class="">      <span class="">&lt;md:ServiceName </span><span class="">xml:lang=</span><span class="">&quot;en&quot;</span><span class="">&gt;</span>ASH SAML Service Provider Portal<span class="">&lt;/md:ServiceName&gt;</span></p>

<p class=""><span class="">      </span><span class="">&lt;md:RequestedAttribute </span><span class="">NameFormat=</span>&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;<span class=""> </span><span class="">Name=</span>&quot;UniqueMemberID&quot;<span class=""> </span><span class="">isRequired=</span>&quot;True&quot;<span class=""> /&gt;</span></p>

<p class=""><span class="">      </span><span class="">&lt;md:RequestedAttribute </span><span class="">NameFormat=</span>&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;<span class=""> </span><span class="">Name=</span>&quot;MemberSuffix&quot;<span class=""> </span><span class="">isRequired=</span>&quot;True&quot;<span class=""> /&gt;</span></p>

<p class=""><span class="">      </span><span class="">&lt;md:RequestedAttribute </span><span class="">NameFormat=</span>&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;<span class=""> </span><span class="">Name=</span>&quot;Email&quot;<span class=""> </span><span class="">isRequired=</span>&quot;False&quot;<span class=""> /&gt;</span></p>

<p class=""><span class="">    </span>&lt;/md:AttributeConsumingService&gt;</p>
<p class="">…</p>
<p class=""><br></p>
<p class="">I can add custom attributes like</p>
<p class=""><br></p>
<p class="">&lt;!-- UniqueMemberID for HealthRoads SP is employee # = bannerID per UA Benefits--&gt;</p>
<p class=""><span class="">&lt;resolver:AttributeDefinition </span><span class="">id=</span>&quot;UniqueMemberID&quot;<span class=""> </span><span class="">xsi:type=</span>&quot;Simple&quot;<span class=""> </span><span class="">xmlns=</span>&quot;urn:mace:shibboleth:2.0:resolver:ad&quot;</p>

<p class="">sourceAttributeID=<span class="">&quot;BannerID&quot;</span><span class="">&gt;</span></p>
<p class=""><span class="">        </span>&lt;resolver:Dependency <span class="">ref=</span><span class="">&quot;myLDAP&quot;</span> /&gt;</p>
<p class=""><span class="">        </span><span class="">&lt;resolver:AttributeEncoder </span><span class="">xsi:type=</span>&quot;SAML2String&quot;<span class=""> </span><span class="">xmlns=</span>&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot;</p>

<p class=""><span class="">        </span>                          <span class="">name=</span><span class="">&quot;UniqueMemberID&quot;</span> </p>
<p class=""><span class=""><span class="">        </span>                          </span><span class="">nameFormat=</span>&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;</p>
<p class=""><span class="">        </span>                          <span class="">friendlyName=</span><span class="">&quot;UniqueMemberID&quot;</span>/&gt;</p>
<p class="">&lt;/resolver:AttributeDefinition&gt;</p>
<p class=""><br></p>
<p class=""><br></p>
<p class="">but should I have concerns other than tidiness of my attribute-resolver and -filter and precedent for unscalable process of custom named attributes for every SP?</p>
<p class=""><br></p>
<p class="">Is there a better way to deal with needs of this and potential similar service side requirements?</p>
<p class=""><br></p>
<p class="">David Bantz</p>
<p class="">U Alaska IAM</p></div>