NameID encoding

[Eric Goodman]

Hi all,

These questions are more conceptual than technical:

I've got a couple of SPs that require specific NameID values -- that is, they need a specific attribute to be passed as the NameID in the subject of the assertion rather than in arbitrary attributes. When configuring the attribute release policies, I'm confused by what I'm expected to use as the nameFormat for these NameIDs.

On one hand, which nameFormat should be used seems like a somewhat meaningless question; I think I can use any string in the nameFormat, as long as the SP and the IdP agree on it. But what confuses me are a couple of things:


*         I see nameFormats listed with differing urn scopes in different docs and config files. E.g., "urn:oasis:names:tc:SAML:N.M:nameid-format:transient" has different values for the SAML version (1.0, 1.1, 2.0). Are the SPs ignoring the SAML version value in the URN?

o   Even in the saml-core-2.0-os.pdf spec document (http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) there's disagreement: line 460 lists "unspecified" scoped as SAML:1.0, but on line 3282, where it's officially defined, it shows up as SAML:1.1.

o   That said, I've never seen a complaint from an SP about an invalid nameid format even though I can't imagine all the SPs are using the same version number in their requests.



*         The ID I'm using is unique and persistent (in the literal English sense), but is not opaque, so it is not a "persistent NameID" (in the SAML sense). Sounds like I need to create a custom type?

o   If I do use a custom type, should the name include the "urn:oasis:names:tc..." header ? It seems like I actually need to scope it with my own local urn header, since oasis didn't define the value, but I don't see any actual customID examples to crib from.

o   There's a comment on the wiki that I can use the default "...:unspecified", but it sounds from the context like that's discouraged if the SP and IdP can handle custom IDs. Is that correct? (Referring to: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier)

Again, none of these are pressing, but since I'm doing more than one nameID config exercise I thought I should follow best practices, assuming they exist.

Thanks!

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130115/361ff956/attachment.html