search

UWIT-IAM / uw-idp-custom

Local IdP configuration and etc customizations
0 stars 0 forks source link

Create new attribute for "GWS Unscoped" values #87

Open chmc3 opened 2 weeks ago

chmc3 commented 2 weeks ago

This issue is to capture the work originally started in REQ9284675 and discussed in this thread.

A new attribute should be added to the idP and to the SP Registry. This attribute should be public, and use a new attribute value (it should not use urn:oid:1.3.6.1.4.1.5923.1.5.1.1). There is discussion in the thread linked above around how to take such action. I do not know that we have done such a "new" attribute value before so this may be a "medium" sized task.

The new attribute should largely copy the format of the existing "gws_groups"/urn:oid:1.3.6.1.4.1.5923.1.5.1.1 attribute. This includes the default behavior to not release all values but instead to release only the selected groups.

The table below details the values that should be used for the creation:

SP Registry Name FriendlyName Name Type Source Example Value
gws_groups_unscoped isMemberOf_unscoped TBD multi-value string GWS uw_employee

Once the configuration and creation is complete, please re-assign this request to me to update documentation before the issue is closed (likely part of the change record we should put together for release).

chmc3 commented 1 week ago

After discussion, the "Name" value should be 1.2.840.113994.200.110 and I am updating https://wiki.cac.washington.edu/display/infra/UW+Directory+Services+defined+OID+registry to track we are using the value. Let's move forward with a non-change update, let me know when I should look to test this new attribute.