use of Scoping element in AuthnRequest to assist with front-channel attribute aggregation

[Tom Scavo]

On Mon, Nov 25, 2013 at 11:52 AM, Scott Koranda <skoranda at gmail.com> wrote:
>
> I have come across some work on so-called "front-channel attribute
> aggregation" that is using a <Scoping> element as part of an
> <AuthnRequest> element to include the entityID of an IdP already used
> to authenticate the subject. The entityID for the IdP is included in
> an <IDPList> element.
>
> The <AuthnRequest> is sent from the SP to an "attribute authority"
> that is then using the entityID of the IdP to cause the browser to go
> through another authentication with the IdP but this time sending the
> assertion to the attribute authority, which then uses the targeted ID
> sent by the IdP to the attribute authority to look up attributes for
> the subject.

The IdP in the middle is called an IdP Proxy. It may issue attributes
like any other IdP. I see why you're calling it an "attribute
authority" but I think it's better to call it an IdP Proxy.

> The <AuthnRequest> looks something like this:
>
> <samlp:AuthnRequest
>   xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>   AssertionConsumerServiceURL="https://myservice.edu/some/acs"
>   Destination="https://attribute.authority.edu/some/url"
>   ID="_b8f5f2a1361f90a4611caa60b908dc28"
>   IssueInstant="2013-11-21T11:59:30Z"
>   ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>   Version="2.0">
>   <saml:Issuer
>     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://myservice.edu</saml:Issuer>
>   <samlp:NameIDPolicy AllowCreate="1"/>
>   <samlp:Scoping>
>     <samlp:IDPList>
>       <samlp:IDPEntry ProviderID="https://some.idp.edu"/>
>     </samlp:IDPList>
>   </samlp:Scoping>
> </samlp:AuthnRequest>
>
> Questions:
>
> 1) Is there any defined profile that addresses this type of
> front-channel attribute query or aggregation?

By OASIS? No, I don't think so.

> 2) Any comments on the use of an <AuthnRequest> to the attribute
> authority to solicit attributes about the subject?

Apparently, simpleSAMLphp (SSP) supports IdP scoping out of the box:

http://simplesamlphp.org/docs/stable/simplesamlphp-scoping

We have a couple of instances of SSP in-house but haven't come across
this feature yet.

> 3) Any comments on the use of the <Scoping> element to signal to the
> attribute authority to which IdP to direct the browser to complete the
> assertion of a name identifier from the IdP to the attribute
> authority?

Sure, why not? All the usual caveats wrt IdP Proxies apply, however.

Tom