Shibboleth IdP 4, SAML proxying and SimpleSAMLphp proxy breakage?

[Cantor, Scott]

On 2/23/21, 1:53 PM, "users on behalf of Robert Bradley" <users-bounces at shibboleth.net on behalf of robert.bradley at it.ox.ac.uk> wrote:

>    My gut says the "correct" behaviour should be to use the last 
>    AuthenticatingAuthority or Issuer instead, but I can see that breaking 
>    with hub-spoke federations like SURFconext.  Another option would be to 
>    just take the NameQualifier attribute from the NameID (if present) and 
>    use that.

In case it isn't obvious, enforcing the right of the Issuer to assert a NameQualifier is just a URI-based version of scope checking (the Shibboleth SP does this based on assuming equality).

It's what OIDC assumes is being done, in essence, by treating iss as the implicit scope of the sub, and proxying (which OIDC does not to my knowledge define semantics for) will out of necessity screw with all that (which is why I advocate independently scoping sub with domain suffixes). But that's an aside.

Just pointing out that this is dangerous territory to "automate" without some care if the eventual RP isn't doing its job to start with.

-- Scott