Attribute resolution for private credentials in subject

[joller lee]

Thanks for your answer.
It suffices for my case.

On Fri, Mar 11, 2016 at 9:38 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > As a related question, may I safely assume in the SubjectContext there is
> > only one subject, in which there is only one private credential? (In my
> case,
> > LDAP authn is used, with session enabled.)
>
> None of this is formally documented at the moment, but the authentication
> contract for the SSO profiles right now is that the SubjectContext will
> contain all of the AuthenticationResults associated with the subject and a
> canonical principal name associated with the identity.
>
> It does not assume there's only one Subject, let alone what might be all
> of them.
>
> However, the only way you get multiple Subjects at the same time is if you
> have multiple types of AuthenticationResult. Only a single result is
> tracked per login flow ID. So if you only have one login flow enabled (e.g.
> authn/Password), then you can only have one type of AuthenticationResult,
> ergo one Subject at a time. If you know what the flow is doing to populate
> that Subject, then you know what can be in it.
>
> So, it depends, but you can control what assumptions you can make.
>
> It's also profile dependent. SAML Attribute Queries produce a Subject
> based on mapping the NameID in the query to a Subject that contains the
> reverse-mapped username and the NameID itself as a custom Principal, and
> that's a totally different Subject than the one you would have during SSO.
>
> The abstraction is consistent, but not the content.
>
> HTH,
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160311/a3f96298/attachment.html>