IdPv3 and Hathitrust: how to resolve and release SAML

[Wang, Lihua]

Interesting discussion.

Based on the following article: https://technet.microsoft.com/en-us/library/cc961625.aspx?ppud=4

GUID seems really really stable (unique across the world, and it ACTUALLY will never change.

Does it make sense to use GUID of active directory as the seed?


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: Monday, July 10, 2017 2:32 PM
To: users at shibboleth.net
Subject: users Digest, Vol 73, Issue 30

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://urldefense.proofpoint.com/v2/url?u=http-3A__shibboleth.net_mailman_listinfo_users&d=DwICAg&c=8v77JlHZOYsReeOxyYXDU39VUUzHxyfBUh7fw_ZfBDA&r=Id_j4nGi6bAcWCQuYduK7uF7Ms11GUv4t0rqmK4OeRk&m=97L_Be_QnuftO4uMCANv1SB3kd0y1yHQ8IxuH-8OfgY&s=wovhkNvnANqlPFtNwtM95bfrK50a-E2rlRKqc_bEbOs&e=
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."


Today's Topics:

   1. Re: IdPv3 and Hathitrust: how to resolve and release SAML
      (Peter Schober)
   2. Re: Error in MFA with disallowed AUTHNCONTEXT + requested
      PasswordProtectedTransport (Leite, Zailo S.)
   3. RE: Error in MFA with disallowed AUTHNCONTEXT + requested
      PasswordProtectedTransport (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Mon, 10 Jul 2017 20:08:15 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: IdPv3 and Hathitrust: how to resolve and release SAML
Message-ID: <20170710180815.GA1345 at aco.net>
Content-Type: text/plain; charset=us-ascii

* Cantor, Scott <cantor.2 at osu.edu> [2017-07-10 19:37]:
> I'm just trying to highlight "don't support it" as a choice as much as 
> I can.

It may be the existence of the latter case (see below) that prompts some IDPs to deploy with less suitable starting values.

Or it's the federation operators' fault aiming to maximize the interop between SPs and IDPs, pushing IDPs to support something that many SPs couldn't care less about.  And all with the best of intentions. (What do they say about The Road To hell? ;))

> Whether it makes sense for an SP to ever simply say "I won't accept a 
> non-targeted value" is a very interesting question worth exploring.

At least within Europe I can imagine this being a function of trying to minimize their legal risk (or maximize their compliance) at a given day and legislation when `rand() mod 2` evaluates to 1, signifying that persistent NameIDs now do [not] constitute PPII.
-peter


------------------------------

Message: 2
Date: Mon, 10 Jul 2017 18:22:43 +0000
From: "Leite, Zailo S." <zleite at caltech.edu>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: Re: Error in MFA with disallowed AUTHNCONTEXT + requested
	PasswordProtectedTransport
Message-ID: <1499710963.8892.15.camel at caltech.edu>
Content-Type: text/plain; charset="utf-8"

On Mon, 2017-07-10 at 17:24 +0000, Cantor, Scott wrote:
> > OK, thanks for the clarification, but what's the solution then?
> 
> If an SP asks for something specific, you either let it (and give it what it asks for) or you stop it from asking or you accept that it will fail if it does. The only allowable outcomes to a request like this is "satisfy it or return an error". The blocking feature is just a way to force the second outcome rather than end up doing something you don't want done.
> 
> An SP asking for "password" is  probably broken because outside of some very unusual cases, that doesn't make any real sense. So it probably needs to be be fixed.
> 
> > If I don't use disallowedFeatures, the ordered list of principals 
> > won't be enforced.
> 
> SAML requires that an SP asking for something get what it asks for. That's not something the IdP can ignore. We don't offer a "not compliant" mode.
> 
> -- Scott
> 

Sorry, I wasn't clear. What I mean is that if the solution proposed in the wiki (use of an ordered list of principals) is not applicable if the SP requests an AuthenticationMethod (and I have two so far, Code42 and Slack, Password and PPT respectively), how do I force the MFA flow to run?

Z

------------------------------

Message: 3
Date: Mon, 10 Jul 2017 18:31:50 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: Error in MFA with disallowed AUTHNCONTEXT + requested
	PasswordProtectedTransport
Message-ID:
	<9846A6064BD102419D06814DD0D78DE13BCA3CF8 at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="us-ascii"

> Sorry, I wasn't clear. What I mean is that if the solution proposed in 
> the wiki (use of an ordered list of principals) is not applicable if 
> the SP requests an AuthenticationMethod (and I have two so far, Code42 
> and Slack, Password and PPT respectively), how do I force the MFA flow 
> to run?

You can't, at least until 3.4, but the underlying cause is still that the SP is behaving inappropriately.

-- Scott



------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 73, Issue 30
*************************************