Requested Attributes in Metadata
Requested attributes in SP metadata are used by the IdP to make runtime decisions with respect to attribute release. Along with other user interface elements, requested attributes are also used to construct the user consent page at the IdP.
The administrative interface has input fields for one or more requested attributes. By submitting these fields, the administrator adds the corresponding attributes to metadata. See the following page for guidance:
Technical Details
The SAML V2.0 Metadata specification (one of the SAML V2.0 family of specifications) supports zero or more <md:AttributeConsumingService>
elements each containing one or more <md:RequestedAttribute>
elements in SP metadata. These static elements are used to communicate SP attribute requirements to IdPs.
InCommon metadata supports at most one <md:AttributeConsumingService>
element. An example follows:
<!-- Requested Attributes for InCommon SPs --> <md:AttributeConsumingService index="1" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> <md:ServiceName xml:lang="en">...</md:ServiceName> <md:ServiceDescription xml:lang="en">...</md:ServiceDescription> <!-- SAML V1.1 attribute syntax --> <md:RequestedAttribute NameFormat="urn:mace:shibboleth:1.0:attributeNamespace:uri" Name="urn:mace:dir:attribute-def:eduPersonPrincipalName" FriendlyName="eduPersonPrincipalName"/> <md:RequestedAttribute NameFormat="urn:mace:shibboleth:1.0:attributeNamespace:uri" Name="urn:mace:dir:attribute-def:displayName" FriendlyName="displayName"/> <!-- SAML V2.0 attribute syntax --> <md:RequestedAttribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" FriendlyName="eduPersonPrincipalName"/> <md:RequestedAttribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:2.16.840.1.113730.3.1.241" FriendlyName="displayName"/> </md:AttributeConsumingService>
Note that two <md:RequestedAttribute>
elements are inserted into metadata for every attribute selected from the interface. One of those attributes is a SAML1 attribute while the other is a SAML2 attribute. The IdP will automatically choose one or the other depending on the protocol used.
The isRequired XML Attribute
Note that the (optional) isRequired
XML attribute on the <md:RequestedAttribute>
element has been omitted from the example. Indeed, InCommon metadata does not support the isRequired
attribute since there is no IdP software that supports this feature in SP metadata.
The <md:ServiceName>
and <md:ServiceDescription>
child elements of the <md:AttributeConsumingService>
element correspond to the <mdui:DisplayName>
and <mdui:Description>
child elements of the <mdui:UIInfo>
element, respectively. The administrator enters a single pair of values that the software synchronizes across both pairs of elements. See the User Interface Elements topic for more detail about the <mdui:UIInfo>
element.