(Slightly) different assertions generated for WEB and ACTIVE clients

[Cantor, Scott]

On 4/18/13 4:30 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On the IdP resolver side, I think what you'd want to look into is whether
>there's a way to forcibly set SPNameQualifier in the attribute definition
>itself or the encoder attached to it. None of that code is very familiar
>to me so I'm not aware of all it can do.

This is coming back to me now (I suppressed the memory). So, the IdP has
this ugly disconnect, there are two ways to get a NameID out:

- attribute definition generates an XML structure (a NameID) and encoder
builds a NameID from it
- attribute definition generates a string, and the encoder builds a NameID
around it

For reasons that escape me, the former lets you set SPNameQualifier if you
want to, the latter does not.

To see the two ways in action, compare the default definitions of the
TransientID and the eduPersonTargetedID attribute definitions. ePTID is
the former model, transient the latter.

So the hack I suggested might be workable with a custom copy of the
definition for ePTID that set SPNameQualifier explicitly.

This is all stuff that really needs to get cleaned up. I haven't pestered
anybody on the team about it because we have a lot of fish frying, but
this is one of my sore points.

-- Scott