use of Scoping element in AuthnRequest to assist with front-channel attribute aggregation

[David Chadwick]

Hi Scott

I would be interested to know how this system

a) determines which attributes are required from the AA
b) determines which attributes are required from the IDP
c) can use targeted ID with the AA when it is supposed to be shared
between an IDP and SP. If two SPs have different targeted IDs for the
same user from the same IDP, then how can the AA work properly? Or is
this now an untargeted globally unique non-privacy preserving ID?

regards

David

On 25/11/2013 16:52, Scott Koranda wrote:
> Hello,
> 
> If this is not an appropriate question for this list I would be
> grateful if you could point me to the correct list.
> 
> I have come across some work on so-called "front-channel attribute
> aggregation" that is using a <Scoping> element as part of an
> <AuthnRequest> element to include the entityID of an IdP already used
> to authenticate the subject. The entityID for the IdP is included in
> an <IDPList> element.
> 
> The <AuthnRequest> is sent from the SP to an "attribute authority"
> that is then using the entityID of the IdP to cause the browser to go
> through another authentication with the IdP but this time sending the
> assertion to the attribute authority, which then uses the targeted ID
> sent by the IdP to the attribute authority to look up attributes for
> the subject.
> 
> The <AuthnRequest> looks something like this:
> 
> <samlp:AuthnRequest
>   xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>   AssertionConsumerServiceURL="https://myservice.edu/some/acs"
>   Destination="https://attribute.authority.edu/some/url"
>   ID="_b8f5f2a1361f90a4611caa60b908dc28"
>   IssueInstant="2013-11-21T11:59:30Z"
>   ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>   Version="2.0">
>   <saml:Issuer
>     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://myservice.edu</saml:Issuer>
>   <samlp:NameIDPolicy AllowCreate="1"/>
>   <samlp:Scoping>
>     <samlp:IDPList>
>       <samlp:IDPEntry ProviderID="https://some.idp.edu"/>
>     </samlp:IDPList>
>   </samlp:Scoping>
> </samlp:AuthnRequest>
> 
> Questions:
> 
> 1) Is there any defined profile that addresses this type of
> front-channel attribute query or aggregation?
> 
> 2) Any comments on the use of an <AuthnRequest> to the attribute
> authority to solicit attributes about the subject?
> 
> 3) Any comments on the use of the <Scoping> element to signal to the
> attribute authority to which IdP to direct the browser to complete the
> assertion of a name identifier from the IdP to the attribute
> authority?
> 
> Thank you for your consideration.
> 
> Cheers,
> 
> Scott K
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>