[JIRA] Moved: (SIDP-560) Query handlers should ensure strongly matching NameID in response

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SIDP-560?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor moved IDP-89 to SIDP-560:
--------------------------------------

      Component/s:     (was: SAML2)
                       (was: SAML1)
                   SAML 2
                   SAML 1
    Fix Version/s:     (was: 3.0.0)
                   2.4.0
              Key: SIDP-560  (was: IDP-89)
          Project: Shibboleth IdP 2 - Java  (was: Identity Provider)

> Query handlers should ensure strongly matching NameID in response
> -----------------------------------------------------------------
>
>                 Key: SIDP-560
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-560
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Improvement
>          Components: SAML 1, SAML 2
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>            Priority: Blocker
>             Fix For: 2.4.0
>
>
> I'm continuing to test, but the code leads me to believe that the attribute query handlers are constructing the NameID/NameIdentifier to put into the attribute assertions using the same logic that generates the Subject content of the authentication assertions during SSO. This introduces the possibility of an assertion with a different NameID than the incoming query used, particularly in the case of aggregation scenarios using a non-standard input subject that has no corresponding outgoing NameID encoder.
> I'm adding logic to the SP to enforce the SAML query rules that require a strongly matching NameID in the response. I'm trying to determine whether to enable or disable it by default, depending on this bug and the likelihood of it causing a problem.
> But the fix overall is to handle the query case differently and simply echo back the NameID/NameIdentifier that's used in the query request instead of regenerating it from scratch. 

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira