OpenSAML user discussion

["Scott Cantor" <>]

> Given the following schema constraints:
> 
> 1. AttributeStatements MUST contain at least one Attribute element.
> 2. Attribute elements MUST contain at least one AttributeValue element.

This is fixed in 2.0.

> 3. AttributeValue elements CANNOT contain null or empty strings.

This is a little too strict a reading, IMHO. There's no reason not to allow
empty strings in this case, and the schema certainly permits it.

> B. An AttributeStatement is returned containing all recognized Attributes.
> Any attributes that are null contain a "NULL" string value.  
> The Status returned is Success.
> C. An AttributeStatement is returned containing all recognized Attributes.
> Any attributes that are empty strings contain a "NOVALUE" string value. 
> TheStatus returned is Success.

Returning strings to mean null would be awful. Just about the worst thing
you could do, I would say, and certainly would be completely unintelligible
unless you programmed both ends. The limitation of the schema means that
returning an attribute with no values is essentially impossible until 2.0.
Returning empty string values is certainly possible, just return an empty
element.

But there's no way to distinguish a NULL value from the empty string. But a
null value is really "no value" and that's the thing 1.x doesn't support.

> One question is if there is a true difference between cases A and B.

I wouldn't think so in the typical cases.

> Another is if sending back actual string values for null and empty strings
> could be problematic if "NULL" and "NOVALUE" are actually possible values.

That would just be terrible for all the obvious reasons.

-- Scott