Shibboleth Developers

["Scott Cantor" <>]

> The Response has 1 or more Assertions
> Each Assertion has 1 or more AttributeStatements
> Each Statement has 1 or more Attributes
> Each Attribute has a name, namespace, and one or more Values

I'd like to sort of generalize the Response out of the picture, and just
deal with "a set of assertions" and we can deal with how they get collected
behind the scenes. This is better for WS-Fed support later.

> I haven't worked out the use of the Header and Alias fields. 

Alias is an htaccess thing. It's for assigning a short name to the attribute
for Require rules to use (e.g. require affiliation). Header is the HTTP
Request header name to export the values to. It's not likely to get all that
much outside of Apache.

> I suspect that they might be used to generate a friendly name for the 
> attribute across the program API, but there was no code that attached
> them during the AAP apply() processing.

It can't. Only a server-specific API can do that. Java servlet calls should
be able to add HTTP request headers, I assume.

> Anyway, I need an API to present to some Java application after Shibboleth
> has done all its processing. Assume I have put all this stuff together.
> What attribute name does the application use?

My preference is to use HTTP headers because APIs are language (and
appserver-) specific. I personally don't know why it's necessary to build
dictionary interfaces (IPerson, et al.) when the HTTP components already
provide this. I never saw the advantage.

> Or is there a third alterative?

The "Header" value is what you're looking for, I think.

-- Scott