"entity" nameid format

[Liam Hoekenga]

short version
------------------
I'm reviewing our configuration in preparation for migrating to IdP3, and
I've got a couple of WSO2 based SPs that are asking us to provide the user
information via nameid in the
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity" format.

Looking at the spec, it seems like "entity" isn't really for user
principals.

Is this another poorly behaved SP?  or is this a valid use?

Liam

------------------------------------------------------------------------------------
additional information
------------------------------------------------------------------------------------
If we try to send a more standard nameid format, we see...
2015-09-09 10:39:57,903 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218]
- Policy checking disabled for NameIDPolicy with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:entity
2015-09-09 10:39:57,904 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile
Action AddNameIDToSubjects: Request specified NameID format:
urn:oasis:names:tc:SAML:2.0:nameid-format:entity
2015-09-09 10:39:57,904 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:entity
2015-09-09 10:39:57,905 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
- Trying to generate identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:entity
2015-09-09 10:39:57,906 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile
Action AddNameIDToSubjects: Request specified use of an unsupportable
identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:entity
2015-09-09 10:39:57,910 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event InvalidNameIDPolicy will be handled with response

But looking at the spec, it doesn't seem like
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity" is really for /user/
principals?

http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
8.3.6 Entity Identifier
URI: urn:oasis:names:tc:SAML:2.0:nameid-format:entity
Indicates that the content of the element is the identifier of an entity
that provides SAML-based services (such as a SAML authority, requester, or
responder) or is a participant in SAML profiles (such as a service provider
supporting the browser SSO profile). Such an identifier can be used in the
<Issuer> element to identify the issuer of a SAML request, response, or
assertion, or within the <NameID> element to make assertions about system
entities that can issue SAML requests, responses, and assertions. It can
also be used in other elements and attributes whose purpose is to identify
a system entity in various protocol exchanges.

The syntax of such an identifier is a URI of not more than 1024 characters
in length. It is
RECOMMENDED that a system entity use a URL containing its own domain name
to identify itself.

The NameQualifier, SPNameQualifier, and SPProvidedID attributes MUST be
omitted
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150909/990cafad/attachment-0001.html>