on eduPersonTargetedID (ePTID) and SAML interoperability

[Roberto Benedetti]

hi, Scott.
thanks for replying.

On 23/04/2013 16:43, Cantor, Scott wrote:
> On 4/23/13 10:05 AM, "Roberto Benedetti" <r.benedetti at cineca.it> wrote:
>
>> [1] and [2] are respectively the pieces of assertion coming from a
>> Shibboleth and the SUN IdP.
>
> By choice in the first case. What you want it to send is up to you, not
> the IdP. If you want to use a NameID instead of an attribute, then you can
> do so. Or you can even use both.

I think I know how to do that on the Shibboleth IdP.
are you saying it can be also done on the OpenSSO IdP?

I am at the SP side and all other Shib and SimpleSAML IdPs work as 
expected. we'd prefer not making changes on a production properly 
working service...   -who would?


>
>> as expected, [1] ends up at the SP side with an environment variable
>> made up of the three chunks ("IdP!SP!opaqueID");
>> [2] ends up with the SP entityID omitted (as well as not sent by the IdP).
>
> Also a choice. See the documentation on attribute decoding on how to
> change that if you want the SP name defaulted in.

I think we'll go for a custom rule for that particular IdP (I recall it 
should be possible).


>
>> I tried to read the SAML specs [3] as well as some Shibboleth wiki pages
>> [4] but I cannot say if the Shibboleth implementation came from the
>> specs or if it is the opposite (the egg-or-chicken-problem ;-), anyway
>> that product adheres to the specs and the examples given there.
>
> What spec are you asking about?

http://middleware.internet2.edu/dir/docs/internet2-mace-dir-saml-attributes-200804.pdf, 
sections 2.3.2.1.x.
the Shibboleth IdP *reflects* the "newer, recommended name and value 
syntax" shown in section 2.5.