Proxying a Persistent NameID

[Cantor, Scott]

> I actually managed to send an SPNameQualifier attribute
> with the name of the requesting SP in the NameIDPolicy tag
> sent to the proxied IdP.

That's not a feature anything but Shibboleth would likely support, and even then I'm not sure it's all there. It would also be likely to cause policy issues because that's really a signal requiring an AffiliationDescriptor.

> Yes, I will follow your suggestion. The only thing that bothers
> me is that if one day we decide to dismiss the proxy and
> move back some SPs to the proxied IdP, all persistent
> NameIDs will change (which is, if I understand, precisely the
> reason why pairwise ID are bad !)

A pain to support, not bad inherently. Well intentioned, not realistic in the real world.

But to your point, proxies are always permanent. The chances you could ever remove one after it's in place are extremely low.

My issue with proxies is more about people calling them temporary, which is almost never true. But to make them temporary, yes, you can't use features like this. You'd never get permission to force an ID change like that.

-- Scott