<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Steven,<div><br></div><div>Federated identity is full of network effects. This is one of them. The more people that understand an attribute you're using, the more powerful it is. On the other hand, many applications and communities have attributes that carry nuances not shared with the rest of the world, so they can't recycle an existing attribute. We have eduPersonEntitlement for precisely this use case, and you're welcome to look at it, but it's probably outside your domain.</div><div><br></div><div>I like URL's for attribute names because they could be easily resolved to acquire more information about the attribute someday. OpenID's AX supports that well already.</div><div><br></div><div>Deciding which attribute to use, what to name it, and whether to recycle is an art and not a science, though. Sometimes it's more effective to keep fine-grained attributes and permissions at the service, as well. Some things aren't meant to be centralized. Look at the successful and failed attributes the LDAP/X.500 world ended up with for some good examples on where to draw the line. Perhaps in your case:</div><div><br></div><div>openid.ax.type.(applicationName)Role=<a href="http://yourdomain.org/applicationName/Role">http://yourdomain.org/applicationName/Role</a></div><div>openid.ax.value.(applicationNameRole)=private</div><div><br></div><div>Have fun in the colorful world of attributes,</div><div>Nate.</div><div><br></div><div><div><html>On 21 May 2008, at 19:58, Steven Livingstone-Perez wrote:</html><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I had considered that some attribute “role” with a value yourdomain.org/private and yourdomain.org/public could be universally understood (due to the namespace uniqueness). Even without the namespace this could be useful!<o:p></o:p></p><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></p><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Has anyone got more info on how that have , or perhaps intend to accomplish this?</p></span></blockquote></div><br></div></body></html>