delegation in IDP3

[Brent Putman]

On 7/26/16 4:39 PM, Cantor, Scott wrote:The result was an
"UnknownPrincipal" error returned in the response.
>> I believe we are using the standard v3 transient ID generation.
>>
>> Any ideas on what the problem is here, or what additional config we
>> may be missing?
> I don't think there's anyway to make that work. I don't know if it worked in V2, and if it did, I doubt it was intentional. I suspect there's a mismatch in expectations between the delegation behavior and the transient ID behavior. You'd probably need to file a bug and work around it by using a different form of NameID that doesn't implement checks against the identity of the relying party.
>
> I don't think it's possible to make this work with transients as is, but I don't know if Brent tested that or what it's meant to be doing.

I sent my reply just now before reading yours.  But I think our
interpretations of the Subject c14n error are the same.  I also don't
know for sure if it worked in v2, but the machinery was so different there.

See my other note, I'm pretty sure I know where the error is, and it's
probably fixable pretty easily as long as there is a reliable way to
determine from the Assertion the entityID of the RP to whom the
transient was actually issued.

No, I don't think I ever tested the transient (or persistent) case.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160726/c6ec5dc9/attachment.html>