[JIRA] Updated: (IDP-89) Query handlers should ensure strongly matching NameID in response

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/IDP-89?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated IDP-89:
----------------------------

    Assignee: Scott Cantor  (was: Chad La Joie)

> Query handlers should ensure strongly matching NameID in response
> -----------------------------------------------------------------
>
>                 Key: IDP-89
>                 URL: https://issues.shibboleth.net/jira/browse/IDP-89
>             Project: Identity Provider
>          Issue Type: Improvement
>          Components: SAML 1, SAML 2
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>            Priority: Blocker
>             Fix For: 2.4.0
>
>
> I'm continuing to test, but the code leads me to believe that the attribute query handlers are constructing the NameID/NameIdentifier to put into the attribute assertions using the same logic that generates the Subject content of the authentication assertions during SSO. This introduces the possibility of an assertion with a different NameID than the incoming query used, particularly in the case of aggregation scenarios using a non-standard input subject that has no corresponding outgoing NameID encoder.
> I'm adding logic to the SP to enforce the SAML query rules that require a strongly matching NameID in the response. I'm trying to determine whether to enable or disable it by default, depending on this bug and the likelihood of it causing a problem.
> But the fix overall is to handle the query case differently and simply echo back the NameID/NameIdentifier that's used in the query request instead of regenerating it from scratch. 

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira