Subject in AuthnRequest

[Jurgen Van Oosterwijck]

Hi,

Thanks for the info (and patience).

What is being asked by the customer is for the local identity used by the
SP to be communicated to the partner IdP. It's been described in the
documents that I have received as if the Subject in an AuthnRequest could
be used to do so, but I had already guessed from reading the chapters in
the SAML technical overview on federated identities and my attempts with
Shibboleth, that this would not be the case.

Would there be another way that is supported by Shibboleth and the SAML
specs to communicate the local identity to partners when creating a
federated identity, and to have it used as the federated identifier?

Cheers,
Jurgen


On Thu, Mar 14, 2013 at 1:26 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Jurgen Van Oosterwijck <jurgen.vanoosterwijck at gmail.com> [2013-03-14
> 13:01]:
> > Thanks for that info.
> >
> > I had indeed already seen that thread. It implies that it is not
> > possible to include a Subject element with a dynamically injected
> > local username?
>
> I can only repeat what Scott already said there.
>
> Yes. Only for the parameters which the SP exposes.
> (Seems setting a subject in an authentication request is not a very
> common thing to do. No idea how useful it actually is.)
>
> > Also, that the only possible solution would then be to use an API to
> > generate that request myself e.g. in my application code?
>
> Yes. IMHO you wouldn't need an API for generating a few static lines
> of XML with a couple of variables replaced within, but how you do that
> is really up to you.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130315/64ff974d/attachment-0001.html