delegation in IDP3

[Cantor, Scott]

On 8/10/16, 5:13 PM, "users on behalf of Robert A Basch" <users-bounces at shibboleth.net on behalf of rbasch at mit.edu> wrote:

> Based on Brent's earlier comment that this had worked using another ID
> type, I tried configuring the IdP to issue the emailAddress ID to the
> SPs involved (instead of crypto transient).  This still failed with the
> same SubjectCanonicalization error, but no longer produced the "Transient
> identifier issued to <SP1> but requested by <SP2>" warning also seen when
> using crypto transient IDs.

Well, you'd need to enable the support for reversing the ID regardless. How that works is going to depend on your environment, but the only thing it will support out of the box would be something based on a transform of the email address back into the subject name. That's what the "simple" c14n flow does.

It won't do that for you unless you tell it to support emailAddress format.

https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration

If you did that, then we'll have to dig in further, but out of the box it isn't going to let people probe your system with IDs. That same machinery would apply to attribute queries, for example, so you have to explicitly set it all up.

-- Scott