Subject in AuthnRequest

[Cantor, Scott]

On 3/15/13 3:41 AM, "Jurgen Van Oosterwijck"
<jurgen.vanoosterwijck at gmail.com> wrote:

>What is being asked by the customer is for the local identity used by the
>SP to be communicated to the partner IdP. It's been described in the
>documents that I have received as if the Subject in an AuthnRequest could
>be used to do so, but I had already guessed from reading the chapters in
>the SAML technical overview on federated identities and my attempts with
>Shibboleth, that this would not be the case.

No, that is definitely not what it's for. That's what SPProvidedID is for
in the NameID element, and it's done by issuing ManageNameIDRequest
messages from an SP to the IdP after an identifier from the IdP is
obtained. Shibboleth does not support this.

>Would there be another way that is supported by Shibboleth and the SAML
>specs to communicate the local identity to partners when creating a
>federated identity, and to have it used as the federated identifier?

That's not the same thing. You don't use local identifiers at an as
federated identifiers, really ever. If you did, then using the Subject
would be an appropriate way to communicate that, along with a NameIDPolicy
that indicated some custom Format was required. Shibboleth does not
support sending the Subject that way.

Issuing your own AuthnRequest is trivial. If that's what you need to do,
just do it.

-- Scott