No NameID released

[UA]

Thanks; I was wondering why it wouldn't be ok to release opaque identifier to anyone.

David.Bantz at me.com
David.Bantz at Alaska.edu


> On Aug 11, 2014, at 10:57 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> * David Bantz <dabantz at alaska.edu> [2014-08-12 02:25]:
>> I was wrong about releasing transientId to any service - that’s
>> commented out as historic and replaced with release transientId to
>> InCommon members, and, alas, AWS is not an InCommon member.
> 
> You might also want to reconsider that change.
> 
> There's no harm done in releasing transientIDs to anyone, hence the
> default policy rule (in fact the only thing the IDP is configured to
> release by default).
> 
> And membership in a federation (probably referencing the 'Name' XML
> attribute on an EntitiesDesriptor) may also not be the best choice to
> base attribute release policies on today.
> 
> Also some SAML SPs will fall over with no NameID in the Subject, so
> unless you want to make it your duty to make sure services always get
> added at least transientID in a filter policy rule, why not revert to
> the default behaviour and maybe add a NameID preference to your
> relying-party.xml?  That would ensure that at least transient will be
> there when no other NameID can be released.
> -peter
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net