Subject: [abfab] EAP Naming: removing text about attribute query

From: Sam Hartman <[email-masked]>
Date: Fri, 21 Oct 2011 13:29:51 -0400

So, the current GSS EAP naming attributes document says that if the
mechanism performs an attribute query, the results of that attribute
query are made available using the same gss-api attribute names as if
they were present in the assertion.

This was kind of a hack to support something that our implementation
does and stems from a past misunderstanding on my part about how
Shibboleth SP works.

My assumption was that Shibboleth stuck all the SAML attributes in the
same bucket.

What actually happens is that Shibboleth has a complex configuration and
you can map attributes from SAML assertions into the local attribute
name space. Alternatively you can ask Shibboleth to go perform a SAML
attribute query.

I don't think the IETF specs need to talk about attribute query.  If
attribute query happens it will be something the acceptor does to
itself. It will require configuration and as part of configuring it to
happen you can configure what attributes get mapped to.

however since I'm removing something I want to confirm with the WG.

--Sam

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Oct 2011 12:45:20 -0500

I agree.

---

From: "Cantor, Scott" <[email-masked]>
Date: Fri, 21 Oct 2011 18:19:21 +0000

I agree.

-- Scott