C14N of NameID and NameIdentifier - the nameQualifier (and ideed the SPNameQualifier)

[Cantor, Scott]

On 1/28/14, 8:47 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:
>
>So, three questions:
> - Do we want to check nameQualifier in all relevant C14N stages?

Yes. Transients created by these plugins are by definition always used
between the IdP and SP, so the qualifiers should be set to match them, or
be omitted/defaulted.

> - Is there any value in teaching the TransientId resolver and C14N stage
>about SPNameQualifier as well (currently it doesn't care)?

Yes. That should match the relying party Id or be missing.

> - Just to confirm:  A mismatch these is a
>AuthnEventIds.SUBJECT_C14N_ERROR,
>not a AuthnEventIds.INVALID_SUBJECT (the former stopping the flow dead,
>the
>latter queueing a retry of a different C14N).

No, I would treat it as the latter. It basically means that the identifier
isn't understandable by that flow. It might be by another (not likely in
this case).

I would reserve the ERROR case for a case where the identifier was
understood but functionally things broke. For example, a storage failure,
a crypto failure or expiration of the data, etc. Basically we know it's
ours but can't process it. Does that make sense?

-- Scott