<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 3/4/2014 10:48 AM, Powers, John
George wrote:<br>
</div>
<blockquote cite="mid:CF3B6E21.7792%25powers@rowan.edu" type="cite">
<div>
<div style="font-family: Calibri; font-size: medium;"><span
style="background-color: rgb(255, 255, 255);"><font
face="Verdana,Geneva,Helvetica,Arial,sans-serif"><span
style="font-size: 13px;">So I am working on an existing
Shibboleth Identity Provider, and I realized that none
of the </span></font><span class="bold highlight
search-highlight" style="font-family: Verdana, Geneva,
Helvetica, Arial, sans-serif; font-size: 13px;
font-weight: bold; background-color: rgb(255, 255, 153);">attribute</span><font
face="Verdana,Geneva,Helvetica,Arial,sans-serif"><span
style="font-size: 13px;"> OID names match up with the
conventional names. Now I am working with a Service
Provider, and am hoping this won't become a problem
(especially since there are other service providers that
use this IdP). </span></font></span><br
style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<br style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<span style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">I have some limited experience on the Service
Provider side. Is this a problem for a service provider? I
know service providers can map different <span class="bold
highlight search-highlight" style="font-weight: bold;
background-color: rgb(255, 255, 153);">attributes</span> to
different local names, but do they have this level of
control for each identity provider that they are working
with. </span><br style="font-family: Verdana, Geneva,
Helvetica, Arial, sans-serif; font-size: 13px;
background-color: rgb(255, 255, 255);">
<br style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<span style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">For an example: </span><br style="font-family:
Verdana, Geneva, Helvetica, Arial, sans-serif; font-size:
13px; background-color: rgb(255, 255, 255);">
<span style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">Institution A names their 'last name' <span
class="bold highlight search-highlight"
style="font-weight: bold; background-color: rgb(255, 255,
153);">attribute</span> urn:oid:1.2.3.4 </span><br
style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<span style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">Institution B names their 'last name' <span
class="bold highlight search-highlight"
style="font-weight: bold; background-color: rgb(255, 255,
153);">attribute</span> urn:oid:1.3.2.4 </span><br
style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<br style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">
<span style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);">Can a service provider say to use urn:oid.1.2.3.4 for
Institution A and urn:oid.1.3.2.4 for Institution B?</span></div>
<div style="font-family: Calibri; font-size: medium;"><span
style="font-family: Verdana, Geneva, Helvetica, Arial,
sans-serif; font-size: 13px; background-color: rgb(255, 255,
255);"><br>
</span></div>
<div style="font-family: Calibri; font-size: medium;"><span
style="background-color: rgb(255, 254, 254);"><font
face="Verdana,Geneva,Helvetica,Arial,sans-serif"><span
style="font-size: 13px;">If not, I am worried that I
will have to change all the attributes to use the
standard OID definitions in the IdP, and then need to
contact all other service providers to account for this
change.</span></font></span></div>
</div>
</blockquote>
<br>
You can work around it on the IdP side by defining additional
attributes that encode to the proper names, and using attribute
filters to selectively release either the wacky versions or proper
versions depending on the SP.<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>