Follow-up on question that I recently asked on the users list about name ID support in Shibboleth IdP

[WULMS Alexander]

I understand how the IdP does not play a direct role in the account linking, if using an identity attribute for the federation. This can indeed be done by an account-linking-application running on the SP-side, protected by both the local authentication system and the remote IdP, so that the application knows about both local and remote identity details and can update the local account database with the remote IdP identity data. And by implementing such an account-linking-application in both environments, a two-way link can even be set-up, without any special logic on the IdP.

But how about account unlinking, through the name id management protocol? Or synchronization of identity-changes through the name id management protocol. I have understood from the oasis technical document that the IdP does play an active role in the name id management protocol. Do you foresee support for that on the V3 roadmap?


Thanks and kind regards,
Alex


-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, January 31, 2012 4:13 PM
To: Shib Dev
Subject: Re: Follow-up on question that I recently asked on the users list about name ID support in Shibboleth IdP

On 1/31/12 10:05 AM, "WULMS Alexander" <Alexander.WULMS at swift.com> wrote:
>
>I have meanwhile further read-up on the SAML documentation and have
>understood from the Oasis technical overview document that account
>linking can be performed using an authentication request with appropriate
>options in it, depending on the desired scenario (federation via
>persistent pseudonym identifiers, via transient pseudonym identifiers or
>via identity attributes).

That's about account linking at an SP that already has local accounts. If
your SP has local accounts, you can do this today. The IdP has essentially
nothing to do with it.

Any SP with local identities that adds SSO via a third party is
essentially doing account linking in one form or another.

The IdP does not currently act as an account store directly, or as a
relying party, and therefore has no particular notion of linking. There
are no plans to change that. Back end data stores containing account links
can be leveraged by the IdP just like any other data stores, to allow look
up of data based on multiple kinds of identifiers.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net