Associating SP users with specific IdPs

[Tom Scavo]

On Sun, Mar 24, 2013 at 12:26 PM, Robert Lowe <robertmlowe at rmlowe.com> wrote:
>
> ... since metadata is typically provided by the IdP, doesn't this
> amount to the IdP self-asserting what values it's allowed to send?

In the InCommon Federation, scope is tightly controlled.

>> NameIDs are not scoped (in the sense that eduPersonScopedAffiliation
>> is), they are 3-tuples: IdP identifier, SP identifiers, subject
>> identifier. The wiki has lots more info on NameIdentifiers.
>
> Okay, from my reading of the spec I understand that both NameQualifier and
> SPNameQualifier are optional. I also get the impression that they are rarely
> used—that is, I don't believe I have ever seem them used either in
> examples/documentation, or “in the wild.”

The SAML2 Persistent NameID uses these XML attributes.

> Is there a way for an SP to indicate that it requires them, either via
> metadata or in an AuthnRequest?

No, that's not part of the protocol.

> And the way to filter based on that would be to use a PermitValueRule with
> xsi:type="saml:NameIDQualifierString", is that right? With the expectation
> that they will correspond with the IdP entityID and the SP entityID
> respectively?

I don't know about that. Someone else will have to field that one ;-)

Tom