C14N of NameID and NameIdentifier - the nameQualifier (and ideed the SPNameQualifier)

[Rod Widdowson]

In V2 there seems a certain inconsistency in the checking of the
nameQualifier as extracted from the SAML object.

The TransientPrincipalConnector checks
  - The Requester (SP) entityID against the value stored for entity when the
NameID/NameIdentifier was created
  - the nameQualifier is not looked at.


The CryptoTransientPrincipalConnector checks
  - The Requester (SP) entityID against the value stored for entity when the
NameID/NameIdentifier was created
  - Also checks the Requester (SP) entityID against the value in the
nameQualifier of the SAML object
  - It also checks the SPNameQualifier as well when it is present.

Obviously (AFAICS) the first is vital for detecting replay attacks.  The
second (and third) seems nice to have, just to detect bad configuration or
ham handed malevolence.

But it does seem as though we should be consistent in V3 across all C14N
stages that look at NameID or NameIdentifiers.  

So, three questions:
 - Do we want to check nameQualifier in all relevant C14N stages?
 - Is there any value in teaching the TransientId resolver and C14N stage
about SPNameQualifier as well (currently it doesn't care)?
 - Just to confirm:  A mismatch these is a AuthnEventIds.SUBJECT_C14N_ERROR,
not a AuthnEventIds.INVALID_SUBJECT (the former stopping the flow dead, the
latter queueing a retry of a different C14N).

/Rod