No NameID released

[David Bantz]

Thanks for the clear explanation Scot.

David


On Mon, 11 Aug 2014, at 16:36 , Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 8/11/14, 8:24 PM, "David Bantz" <dabantz at alaska.edu> wrote:
> 
>> Thanks Kevin and Scot.  I think I see.  While there¹s no explicit deny
>> (in any policy for any attribute in my attribute-filter as it happens)
>> prior to explicitly adding the release of transientId to the policy for
>> this service, there was no explicit rule for transientId in an applicable
>> policy.  I was wrong about releasing transientId to any service - that¹s
>> commented out as historic and
>> replaced with release transientId to InCommon members, and, alas, AWS is
>> not an InCommon member.
> 
> That would certainly do it.
> 
>> So in the absence of applicable explicit applicable policy releasing it,
>> transientId cannot be used for NameID - correct?
> 
> In V2, transientId is an attribute, even though it's only purpose is in
> those subject IDs, so it operates like any other attribute, it's default
> deny.
> 
>> It wasn¹t clear in my head that the NameID in the subject had to be based
>> on an attribute that can be released to the relying party; before I
>> commit that to long term memory can you just confirm I¹ve finally got it
>> right?  Or correct me if still needed?
> 
> All the NameID generation in V2 works like that, it's always coming from
> an attribute underneath. V3 does not work that way, because I think it's
> confusing. It will only be based on attribute release if the source of the
> ID is actually an attribute.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140811/9f067288/attachment.bin