Missing Attributes

[Tom Scavo]

On Thu, Jun 21, 2018 at 10:02 AM, Thermal Reboot
<thermalreboot at gmail.com> wrote:
>
>     I guess I'm confused on the idea of scope, I can't find a clear
> definition of it, all the docs I read assume you know what that is.

It might help to review the concept wiki page on NameIdentifiers. [1]
In particular, see the last two columns "Global" and "Qualifier."
Identifiers that are not globally unique must be qualified, either by
issuer ID or by scope (or something else).

It will also help to read the SAML V2.0 Subject Identifier Attributes
Profile, [2] which defines two new scoped attributes. Ample
justification (and caveats) are given in that document.

Note: A relying party ignores the scope of an identifier at its peril.
For example, an RP that relies on email address alone is vulnerable.

HTH,

Tom

[1] NameIdentifiers https://wiki.shibboleth.net/confluence/x/eYBC
[2] https://wiki.oasis-open.org/security/SAMLSubjectIDAttr