Requested/Supported Principals

[Cantor, Scott]

On 5/13/15, 3:22 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:


>
>That's what I'm actively working on now. I'll follow up with results.

I think I found a bug in that plan, but I think I know how to fix it, and 
you basically found the same bug.

>I'm going with the removal route. Based on my analysis I also have to do 
>something like the following:

That's only correct if the request is for exact matching, but more 
generally resetting the matchingPrincipal field is the workaround for the 
bug I found, yes. To handle the complete range of matching rules, you'd 
have to do inject all the Predicate machinery for comparisons and indirect 
the matching process, which is what I need to copy over from the Select 
action to the Finalize action.

>The matchingPrincipal field is what drives population of the SAML 
>AuthnContextClassRef in the message actions down in the SAML profile 
>flows. I didn't see any existing action that sets that field from subject 
>principals, so it seems I have to explicitly deal with it.

It's set up front in Select, but that's the bug, it's not getting reset in 
FinalizeAuthentication if a change has occurred dynamically. And if I do 
it in Finalize I probably can stop setting it in Select, but it's just an 
optimization to do it early and avoid having to re-run all the logic later 
in the majority of cases.

The complete fix is to both address that problem, and then fix the various 
Validate actions so that there's more control over how and when the 
Principals get added to the Subject (or not added as the case may be).

-- Scott