Drafty work on authentication subcontexts

[Cantor, Scott]

On 4/23/13 10:51 AM, "Marvin S. Addison" <marvin.addison at gmail.com> wrote:

>> 
>>https://wiki.shibboleth.net/confluence/display/IDP30/Authentication+and+S
>>es
>> sion+Management
>
>"Identifiers and Profile Subcontexts" section looks good. I was curious
>about the use case for "hintedName;" wasn't self-evident to me.

I know, it's something that was brought up to me from OpenID Connect as
something SAML doesn't support. It's a non-normative hint for IdPs that
handle users with multiple personas and allows the SP to signal which
persona the person might want to use. Or something. Could well end up as
just a protocol-specific thing not captured here.

Also, Brent and I refactored a number of aspects of this from our meeting,
and I'll be getting that all into the wiki. As you can see from my note
yesterday, it's going to take a bit of time.

>I can imagine that it might be helpful to know what component
>authenticated a particular subject; for example, AuthenticationContext
>could store Map<Subject,AuthenticationHandler> to associate them. More
>generally, there may be arbitrary metadata to associate with
>authenticated subjects. (The identity assurance use case comes to mind.)
>Have you given thought to that sort of capability?

I was assuming that the arbitrary metadata would be captured as Subject
principals or credentials per the other point about reusing Subject. Use
cases might change that though.

Anyway, we changed a number of cardinalities in what I drafted, and
decided to factor out the actual subject identification data into a
SubjectContext, so quite a bit of change.

-- Scott