NameID from Subject

[Cantor, Scott]

On 8/5/14, 4:07 AM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>If I copy the NameId:, entityID: and Protocol: information from
>transaction.log from a "recent" transaction and feed it to resolvertest
>then I get some attributes back.

Yes, it's doing an attribute query.

> If I feed in anything I get from the
>persistent-id or transient-id fields in the web server then it doesn't
>work.

I don't know what transient-id field you're talking about. There is no
default mapping rule for a transient NameID by that name. If you created
one, then it would work as above.

Persistent IDs, when generated by a hash, are not in general reversible by
the IdP and are not usable for making a query. In any case, the SP is not
expected to be able to make arbitrary queries to an IdP. That's up to the
privacy policy of the IdP and is reflected in part by what they make
available in the assertion's subject.

> The value in NameID: in the logs never appears in any of the web
>server variables but, for a given user, I always get the same value in
>persistent-id or transient-id.

The only time a persistent-id isn't the NameID is in a SAML 1 assertion
when it's coming from the eduPersonTargetedID attribute. In any case, it's
not usable for making a query and whatever you're trying to do, you can't
do it.

-- Scott