a use case single domain

[Christopher Bongaarts]

On 1/18/2013 8:55 AM, Cantor, Scott wrote:
> On 1/18/13 7:12 AM, "ci_98yr"<ci_98yr at yahoo.com>  wrote:
>
>> >As a follow up Q: I guess my userid q pertains to "persistent/transient"
>> >federation id at both idp and sp
>> >As per my understanding (correct me if wrong), the federation id is used
>> >to
>> >map local userids, for example same user on one system/app might go with
>> >different userid on other. Assume that the two systems have saml sp
>> >interfaces and talking to a predetermined idp.
> None of that pertains to the number of DNS domains. SPs are identified by
> entityID, which is a name. Transient IDs are never used to identify
> people, only sessions. Persistent IDs are non-correlatable across SPs by
> design. If you have a different use case, as most are, you want a
> different NameID format or attribute to carry information.

Just to hang some specific examples on this:

Most of our "internal" applications use one of these attributes as the 
identifier for the user:

uid - Their "Internet ID" aka. "X.500 username" or what everyone else 
seems to call "net ID"

eduPersonPrincipalName - for internal users, this is uid plus a scope of 
"umn.edu" - makes it easier to add other IdPs later on

umnDID - an internal "directory ID" that has better invariance than uid, 
so is better suited as a long-term primary key

Peoplesoft EmplID - for applications that need to deal with Peoplesoft 
for student or HR functions - it's the PS primary key

We have discouraged internal apps from using name identifiers, 
preferring attributes instead, to avoid the Highlander problem (There 
Can Be Only One NameID, but an arbitrary number of attributes).

Shib won't necessarily help you if the two internal apps do not share a 
common identifier - you typically solve that outside of shib via an LDAP 
directory or database table that associates users with their per-app 
identifier.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%