Using Metadata in my App

[Tom Scavo]

On Tue, Mar 26, 2013 at 10:23 AM, Andy Bennett <andyjpb at knodium.com> wrote:
>
> Some IdPs send me an opaque targeted-id, some send an opaque
> persistent-id triple and some send a less opaque eppn plus and opaque
> targeted-id.

Well, there's a (conceptual) problem here since "opaque targeted-id"
and "opaque persistent-id triple" are almost certainly the same thing.

>     <!-- Second, an alternate decoder that will decode the incorrect
> form into the newer form. -->
>     <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
> id="persistent-id">
>         <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder"
> formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQua
> lifiers="true"/>
>     </Attribute>

This is the pre-SAML2 form of ePTID.

>     <!-- Third, the new version (note the OID-style name): -->
>     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
>         <AttributeDecoder xsi:type="NameIDAttributeDecoder"
> formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="t
> rue"/>
>     </Attribute>

This is the SAML2 form of ePTID.

>     <!-- Fourth, the SAML 2.0 NameID Format: -->
>     <Attribute
> name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
> id="persistent-id">
>         <AttributeDecoder xsi:type="NameIDAttributeDecoder"
> formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="t
> rue"/>
>     </Attribute>

This is the SAML2 Persistent NameID, which is 100% equivalent to the
SAML2 form of ePTID.

> I'm not using this one:
> -----
>     <!-- First, the deprecated/incorrect version, decoded as a scoped
> string: -->
>     <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID"
> id="targeted-id">
>         <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
>         <!-- <AttributeDecoder
> xsi:type="NameIDFromScopedAttributeDecoder"
> formatter="$NameQualifier!$SPNameQualifier!$Name" defau
> ltQualifiers="true"/> -->
>     </Attribute>
> -----

I don't see how that's different than the first one above. Someone
else more knowledgeable about the Shib SP will have to review.

>> I think you mean ePPN, in which case, yes, ePPN is globally unique.
>
> ...but I don't get access to the raw ePPN from the SAML exchange. I just
> get some decoded value that involves the entityIDs from "various"
> places. It's not clear to me whether those entityIDs come from the
> configuration (shibboleth2.xml for SP-ID, federation XML for IdP-ID) or
> from the SAML exchange / IdP database backend.

All I can say for sure is the values supplied to the application do
NOT come from metadata. They are asserted by the IdP just-in-time.

>>> What about targeted-id?
>>
>> Technically, no, since ePTID is a triple, one component of which is
>> the IdP's entityID. If the ePTID value was computed correctly by the
>> IdP to being with, you would still obtain that same value after their
>> entityID had changed.
>
> I'm confused. How is that different than from persistent-id? Surely
> anything involving the entityID will change?

Yes, I agree, there's confusion :-)

>> Your goal is laudable but unfortunately the typical SAML metadata file
>> is not up to the task. For an interesting counterexample, see the
>> SWITCH metadata:
>>
>> http://metadata.aai.switch.ch/metadata.switchaai.xml
>>
>> Notice the value of the OrganizationName element in each case.
>> Brilliant, eh? :-)
>
> That looks interesting. The OrganizationName seems to be terse but
> potentially helpful and then they supply human readable names in a
> number of languages in the OrganizationDisplayName attribute.
> It looks like they keep OrganizationName the same for multiple IdPs and
> SPs from the same organisation. Who knows if they guarantee it.

The SWITCH folks frequent this list so someone will respond, I'm sure.

Cheers,
Tom