[JIRA] Updated: (IDP-89) Query handlers should ensure strongly matching NameID in response

[Chad La Joie (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/IDP-89?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chad La Joie updated IDP-89:
----------------------------

    Component/s: SAML2
                 SAML1

> Query handlers should ensure strongly matching NameID in response
> -----------------------------------------------------------------
>
>                 Key: IDP-89
>                 URL: https://issues.shibboleth.net/jira/browse/IDP-89
>             Project: Identity Provider
>          Issue Type: Improvement
>          Components: SAML1, SAML2
>            Reporter: Scott Cantor
>            Assignee: Chad La Joie
>            Priority: Minor
>
> I'm continuing to test, but the code leads me to believe that the attribute query handlers are constructing the NameID/NameIdentifier to put into the attribute assertions using the same logic that generates the Subject content of the authentication assertions during SSO. This introduces the possibility of an assertion with a different NameID than the incoming query used, particularly in the case of aggregation scenarios using a non-standard input subject that has no corresponding outgoing NameID encoder.
> I'm adding logic to the SP to enforce the SAML query rules that require a strongly matching NameID in the response. I'm trying to determine whether to enable or disable it by default, depending on this bug and the likelihood of it causing a problem.
> But the fix overall is to handle the query case differently and simply echo back the NameID/NameIdentifier that's used in the query request instead of regenerating it from scratch. 

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira