Bugzilla – Bug 6477
acceptance of scoped attributes
Last modified: 2008-12-14 16:24:39
You need to log in before you can comment on or make changes to this bug.
Introduce a scoped attribute check into AttributeAcceptancePIP. To accept a scoped attribute (e.g., eduPersonPrincipalName or eduPersonScopedAffiliation), the asserted scope must be known to be associated with the SAML issuer. There are at least three implementation approaches: 1) add a field to the existing entity map; 2) implement a new, flat file-based mapping file with (entityID, scope) ordered pairs; or 3) implement SAML metadata. The implementation choice must be consistent with the implementation of the one-to-many mapping of entityID to DNs (Bug 6427).
(In reply to comment #0) > > There are at least three implementation approaches: 1) add a field to the > existing entity map; 2) implement a new, flat file-based mapping file with > (entityID, scope) ordered pairs; or 3) implement SAML metadata. It seems option (2) makes most sense at this time. Moreover, since multiple scopes are allowed, the mapping file will take the form (entityID, scope1, scope2, ...) This requires some modification to the EntityMap interface.
