NameID from Subject

[Andy Bennett]

Hi,

> SWITCH has developed some tools around that concept, and I think they've
> even used resolvertest to do it in some cases, but you can't do it with a
> transient, and you can't do it with a persistent that's not reversible,
> and you have no way to know whether any given persistent ID is reversible,
> that's not part of the format's contract in SAML.

So it is correct for me to infer that, given my current configuration of
getting persistent-id in the webserver variables, I can try to pass that
value to resolvertest and, if it happens to be reversible then I'll get
a result otherwise there's no hope?


>> I also note that one IDP that talks to us is always sending "staff" as
>> the NameIdentifier: field that appears in the logs. Is this going to
>> cause any problems?
> 
> That's totally wrong. And yes, it can cause problems, though in practice
> it won't matter much if you're not using the data unless you're trying to
> implement SAML logout, or unless they send you a lot of logins in a short
> time window. That will overload a particular aspect of the session cache.
> 
> You should tell them to quit it.

OK. Thanks. I'm trying help them work out what's wrong. Perhaps the
rules under "<!-- Name Identifier related attributes -->" in default IDP
attribute-filter.xml are missing in their copy of the file?



Thanks for your help with this. Sorry to cause such a long thread for
such a seemingly simple issue.





Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/