Shibboleth Developers

["RL 'Bob' Morgan" <>]

On Sun, 13 Jul 2003, Scott Cantor wrote:

> I have this thing seemingly working, at least in the non-LDAP case. What
> were we going to call it?
>
> I tentatively configured it as
> "urn:mace:incommon:attribute-def:PersistentID"

Hmm.  The thing you've implemented is the thing that, say, EBSCO would get
as a persistent but target-specific (and otherwise opaque) ID, so they can
do personalization etc, right?  So by nature this attribute is
"this-user-for-this-target".  I'm wondering whether a single
attribute-type (to use the LDAP term), as you suggest, is the right
approach, or whether this might be better expressed as "the <target> ID
for this user", for the various values of target, eg

  urn:mace:ebsco.com:stuff:our-special-id

or

  http://elsevier.com/personalization-id

I guess the idea of a single type kinda bothers as it means the AA is
responsible for figuring out that when target X asks for that type it gets
one value, and when target Y asks it gets a different value.  Moreover it
prevents cases where target Z might legitimately be able to be given the
persistent ID value for target Y.

Obviously giving each of these things its own type means many types and
registrations, which is a lose.  And there would have to be a mapping from
each of these types to connect it to the id-generation code.  But I'm
inclined to think the additional clarity is worth it.

 - RL "Bob"


------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--