NameID from Subject

[Cantor, Scott]

On 8/5/14, 11:05 AM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>So it is correct for me to infer that, given my current configuration of
>getting persistent-id in the webserver variables, I can try to pass that
>value to resolvertest and, if it happens to be reversible then I'll get
>a result otherwise there's no hope?

Yes. And 99% of the time you won't get an answer. There are very few
people using a database to generate and store those values. It's not worth
your time in other words.

Somebody from SWITCH can comment on how they're pursuing this idea, I
don't know the details of their "liveness" checking solution, but I'm sure
it involves control over the IdPs, or at least strong suggestions. It's
not possible to scale it out beyond a sphere of control.

>OK. Thanks. I'm trying help them work out what's wrong. Perhaps the
>rules under "<!-- Name Identifier related attributes -->" in default IDP
>attribute-filter.xml are missing in their copy of the file?

Filtering rules don't define what ends up in the subject by themselves,
that's a matter of resolution of data and how it's being encoded. The SP's
filtering file has no relationship to the IdP's anyway, they're the same
syntax but they function in essentially opposite ways. Nothing you're
looking at is in an IdP's configuration.

-- Scott