No NameID released

[Cantor, Scott]

On 8/11/14, 8:24 PM, "David Bantz" <dabantz at alaska.edu> wrote:

>Thanks Kevin and Scot.  I think I see.  While there¹s no explicit deny
>(in any policy for any attribute in my attribute-filter as it happens)
>prior to explicitly adding the release of transientId to the policy for
>this service, there was no explicit rule for transientId in an applicable
>policy.  I was wrong about releasing transientId to any service - that¹s
>commented out as historic and
>replaced with release transientId to InCommon members, and, alas, AWS is
>not an InCommon member.

That would certainly do it.

>So in the absence of applicable explicit applicable policy releasing it,
>transientId cannot be used for NameID - correct?

In V2, transientId is an attribute, even though it's only purpose is in
those subject IDs, so it operates like any other attribute, it's default
deny.

>It wasn¹t clear in my head that the NameID in the subject had to be based
>on an attribute that can be released to the relying party; before I
>commit that to long term memory can you just confirm I¹ve finally got it
>right?  Or correct me if still needed?

All the NameID generation in V2 works like that, it's always coming from
an attribute underneath. V3 does not work that way, because I think it's
confusing. It will only be based on attribute release if the source of the
ID is actually an attribute.

-- Scott