Associating SP users with specific IdPs

[Robert Lowe]

> > What exactly in the metadata would enable that?
>
> <shibmd:Scope regexp="false">example.org</shibmd:Scope>
>
> See also attribute-policy.xml in the SP's config directory.
>

Thanks Peter. If I'm understanding this right, adding shibmd:Scope has no
effect by itself, but needs to be combined with one or more Rules with
xsi:type="saml:AttributeScopeMatchesShibMDScope" in attribute-policy.xml.
Is that right?

Moreover, since metadata is typically provided by the IdP, doesn't this
amount to the IdP self-asserting what values it's allowed to send?


>
> > > You could also rely on the  NameID construct and its qualifiers and do
> > > filtering based on that, along with having flexibility in how you
> serialize
> > > the NameID structure into an identifier to consume.
> >
> > Other than scope, what qualifiers of NameID would be relevant here?
>
> NameIDs are not scoped (in the sense that eduPersonScopedAffiliation
> is), they are 3-tuples: IdP identifier, SP identifiers, subject
> identifier. The wiki has lots more info on NameIdentifiers.
>

Okay, from my reading of the spec I understand that both NameQualifier and
SPNameQualifier are optional. I also get the impression that they are
rarely used—that is, I don't believe I have ever seem them used either in
examples/documentation, or “in the wild.”

Is there a way for an SP to indicate that it requires them, either via
metadata or in an AuthnRequest?

And the way to filter based on that would be to use a PermitValueRule with
xsi:type="saml:NameIDQualifierString", is that right? With the expectation
that they will correspond with the IdP entityID and the SP entityIDrespectively?

-- 
Best regards,

Robert Lowe
http://notability.rmlowe.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130325/cc157ec3/attachment.html