on eduPersonTargetedID (ePTID) and SAML interoperability

[Roberto Benedetti]

hi all.

while trying to make a Shibboleth SP (v-2.4.3) and a non-Shibboleth IdP 
(ex-SUN OpenSSO) interoperate, we encountered two problems (hence this 
and the next message/thread).

[1] and [2] are respectively the pieces of assertion coming from a 
Shibboleth and the SUN IdP.

as expected, [1] ends up at the SP side with an environment variable 
made up of the three chunks ("IdP!SP!opaqueID");
[2] ends up with the SP entityID omitted (as well as not sent by the IdP).

I tried to read the SAML specs [3] as well as some Shibboleth wiki pages 
[4] but I cannot say if the Shibboleth implementation came from the 
specs or if it is the opposite (the egg-or-chicken-problem ;-), anyway 
that product adheres to the specs and the examples given there.

is [2] SAML compliant?
would an appropriate encoder populate the missing chunk?

thanks in advance,
   roberto benedetti


[1]
<saml2:Attribute FriendlyName="eduPersonTargetedID" 
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml2:AttributeValue>
             <saml2:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
NameQualifier="%Shibboleth-IdP-entityID%" 
SPNameQualifier="%SP-entityID%">a4269769-888a-44c2-94f0-5133b806abb2</saml2:NameID>
          </saml2:AttributeValue>
</saml2:Attribute>


[2]
<saml:Subject>
             <saml:NameID 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" 
NameQualifier="%Non-Shibboleth-IdP-entityID%">mgPwsLsT1ur/yTL+v5kuvAaYDAel</saml:NameID>
             <saml:SubjectConfirmation 
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                 <saml:SubjectConfirmationData 
InResponseTo="_872c46cb0ec7f86bfee82a48a9d7fb52" 
NotOnOrAfter="2013-04-16T12:08:58Z" Recipient="%SP-ACS%" />
             </saml:SubjectConfirmation>
</saml:Subject>


[3] 
http://middleware.internet2.edu/dir/docs/internet2-mace-dir-saml-attributes-200804.pdf


[4] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID