delegation in IDP3

[Cantor, Scott]

> Second, while it is now properly referencing the predicate bean, it is
> not evaluating it in the way I expected, i.e. where its parent is
> "shibboleth.Conditions.RelyingPartyId" and it contains (in the override
> for the second-tier SP) a list of the first-tier SPs allowed to present
> requests.  But, changing this bean to the "alwaysTrue" predicate does
> make it get past the evaluation successfully, so there must still be
> something about this predicate (or perhaps another setting) I am not
> getting.

I don't really know the policy model here, been too many years. It's possible you have the identities backwards from the way it's intended to work, and with no docs, there's nothing I can go on.

> The result was an "UnknownPrincipal" error returned in the response.
> 
> I believe we are using the standard v3 transient ID generation.
> 
> Any ideas on what the problem is here, or what additional config we
> may be missing?

I don't think there's anyway to make that work. I don't know if it worked in V2, and if it did, I doubt it was intentional. I suspect there's a mismatch in expectations between the delegation behavior and the transient ID behavior. You'd probably need to file a bug and work around it by using a different form of NameID that doesn't implement checks against the identity of the relying party.

I don't think it's possible to make this work with transients as is, but I don't know if Brent tested that or what it's meant to be doing.

-- Scott