NameID from Subject

[Cantor, Scott]

On 8/5/14, 10:31 AM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>I'm primarily looking to be able to go back later (weeks or months) and
>ask whether the accounts are still existing at the IDP.

You can't do that with a transient ID.

SWITCH has developed some tools around that concept, and I think they've
even used resolvertest to do it in some cases, but you can't do it with a
transient, and you can't do it with a persistent that's not reversible,
and you have no way to know whether any given persistent ID is reversible,
that's not part of the format's contract in SAML.

In SAML terms, provisioning is/was a separate problem, and it's not really
meant to be handled with attribute queries.

>If I put <NameID> elements in my SP Metadata will I easily be able to
>get more persistent NameIDs that I can use for this purpose or will it
>generally require some changes on the IDP side? i.e. will an IDP with a
>default configuration be expected to pass more persistent data?

No, you will rarely see any impact from doing that, and it won't help you
anyway because most IdPs generate persistent values using a hash that
isn't reversible, so they can't tell you whether that value still exists.

>I also note that one IDP that talks to us is always sending "staff" as
>the NameIdentifier: field that appears in the logs. Is this going to
>cause any problems?

That's totally wrong. And yes, it can cause problems, though in practice
it won't matter much if you're not using the data unless you're trying to
implement SAML logout, or unless they send you a lot of logins in a short
time window. That will overload a particular aspect of the session cache.

You should tell them to quit it.

-- Scott