R: Modify tag issuer in LogoutRequest

[Marcello Marangio]

Hi.
Just to fully understand this aspect of shibboleth.

In the same italian regulation we have been asked to put the same 2
attributes in the issuer tag within the AuthnRequest, too.

As I ignored the section 8.3.6., a while ago I implemented it in
shibboleth2.xml, using the "inline template" in the sessioninitiator:

<SessionInitiator type="SAML2"  acsIndex="1"
template="bindingTemplate.html"
authnContextClassRef="https://www.spid.gov.it/SpidL2"
authnContextComparison="exact">
   <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ForceAuthn="true" ID="ID0001" Version="2.0"
IssueInstant="2016-05-23T08:08:24Z" AttributeConsumingServiceIndex="1">
   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
NameQualifier="http://spid-test.rupar.puglia.it"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://spid-test.r
upar.puglia.it</saml:Issuer>
   <samlp:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
   </samlp:AuthnRequest>
</SessionInitiator>

This generates what I expected:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="http://spid-test.rupar.puglia.it/servizioOnline
0/Shibboleth.sso/SAML2/POST" AttributeConsumingServiceIndex="0"
Destination="https://identitycl.infocert.it/spid/samlsso"
ID="_e848c11b4aae3b5a3c660bb30bcd515a" IssueInstant="2016-11-08T13:58:03Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
NameQualifier="http://spid-test.rupar.puglia.it">http://spid-test.rupar.pugl
ia.it</saml:Issuer>
  <samlp:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
  <samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://www.spid.gov.it/S
pidL1</saml:AuthnContextClassRef></samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

So, Format entity and namequalifier in the issuer tag, against section
8.3.6.
I cannot find anything in the saml specs that makes this legal. 

Am I missing something again?

Thanks
M

-----Messaggio originale-----
Da: users [mailto:users-bounces at shibboleth.net] Per conto di Cantor, Scott
Inviato: lunedì 7 novembre 2016 18:06
A: Shib Users
Oggetto: RE: Modify tag issuer in LogoutRequest

> The modification I would like to have is compliant to the SAML2 specs.

No, it's not.

> It is a valid saml2 Issuer element.

A valid element syntactically can still be invalid semantically. The Format
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity" does not need to be
explicit (it's the default for Issuer) but in either case, that Format is
explicitly documented in the standard and does not allow NameQualifier or
SPNameQualifier to be set. See section 8.3.6 of SAML Core.

It's a pedantic matter, but it speaks to somebody misusing the spec to do
something wrong, and it's about you asking the software to be changed or
configurable to let you do something the standard precludes. That's not
sensible and it will not allow you to.

-- Scott

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net