Principal Connectors

[Cantor, Scott]

On 3/2/13 8:29 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>I have started checking in the code for the principal connectors.  It's
>all
>pretty non-controversial, but the detailed reasoning is in
>https://issues.shibboleth.net/jira/browse/IDP-265#comment-14968 .  Any
>comments would be welcome here or in that case..

Regarding where the code should live, I anticipate it moving out of the
resolver. The existing PrincipalConnectors already get used by the SAML 2
SSO profile handler to reverse a NameID inside an AuthnRequest.

It's shared code in the SAML 2 profile handler base class
(resolvePrincipal) and it calls AttributeAuthority.getPrincipal.

After thinking about it more I'm hard pressed to see any actual
distinction between the PrincipalConnector concept in V2 and the name
canonicalization idea we discussed in Columbus.

If you think of a SAML NameID as just one of many tech-specific forms of
name (like a DN is another), you see that it's really one idea.

-- Scott