Follow-up on question that I recently asked on the users list about name ID support in Shibboleth IdP

[WULMS Alexander]

Hi,

Thanks for the clarification. We were confused here about intended usage of the SAML Name Identifier Mapping protocol. 

I have meanwhile further read-up on the SAML documentation and have understood from the Oasis technical overview document that account linking can be performed using an authentication request with appropriate options in it, depending on the desired scenario (federation via persistent pseudonym identifiers, via transient pseudonym identifiers or via identity attributes).

Does the current version (v2) or the future version (v3) of the IdP support any of those scenario's? Our high-level design is at the moment favouring account linking via identity attributes.

Thanks and kind regards,
Alex


-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, January 12, 2012 4:11 PM
To: Shib Dev
Subject: Re: Follow-up on question that I recently asked on the users list about name ID support in Shibboleth IdP

On 1/12/12 6:59 AM, "WULMS Alexander" <Alexander.WULMS at swift.com> wrote:

>We manage two different environments, each having its own user database.
>In one environment, users have to authenticate based on a PKI setup, with
>a certificate. In the other environment, users have to authenticate with
>a username/password. Some people have an account in both environments. In
>order to make life easier for them, we want to set-up SAML based SSO
>between the two environments. In order for this to work, the users with
>an account in both environments must be able to link the two accounts.

Generally account linkiing requires either a back office process, or a
front channel interaction involving both an SP and an IdP. You accept an
assertion from one IdP into the other, basically, to authenticate the
foreign identifier to link to a local one. It isn't something you can
easily add to the IdP today, it's a large amount of work because of the
need for local authentication at the same time you do the SAML part.

> If possible, we would prefer to link the accounts using the SAML Name
>Identifier Mapping protocol.

I don't see any obvious way for that to work. The mapping protocol is
designed to crosswalk between existing links, not create them.

> Furthermore, we would also like to give the users the possibility to
>unlink the accounts again, preferably using the SAML Name Identifier
>Management Protocol.

That part would work.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net