Thanks a lot for your answer.<br><br>One use case I want to confirm is that, if I send this SAML2.0 AuthnRequest:<br><br><span><saml2p:AuthnRequest </span><span>AssertionConsumerServiceURL</span>="<span>...</span>" <span>Destination</span>="<span><a href="https://localhost/idp/profile/SAML2/Redirect/SSO" target="_blank">https://localhost/idp/profile/SAML2/Redirect/SSO</a></span>" <span>ID</span>="<span>_a90ed2b44c1d25860c411e0ab27a9edd</span>" <span>IssueInstant</span>="<span>2012-07-31T18:21:28.759Z</span>" <span>ProtocolBinding</span>="<span>urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</span>" <span>Version</span>="<span>2.0</span>" <span>xmlns:saml2p</span>="<span>urn:oasis:names:tc:SAML:2.0:protocol</span>"<span>></span><br>
<span><saml2:Issuer </span><span>xmlns:saml2</span>="<span>urn:oasis:names:tc:SAML:2.0:assertion</span>"<span>></span><br> .....<br> <span></saml2:Issuer</span><span>></span><br>
<span><saml2p:NameIDPolicy </span><span>AllowCreate</span>="<span>true</span>" <span>Format</span>="<span>urn:mace:shibboleth:1.0:nameIdentifier</span>"/<span>></span><br>
<span></saml2p:AuthnRequest</span><span>><br><br>First of all, is this a valid AuthnRequest? Because I am using SAML2, but in NameIDPolicy, I specified </span><span>urn:mace:shibboleth:1.0:nameIdentifier..<br><br></span><span>In order to comply with the SAML2.0 standards, what should be replied from IdP? OOTB Shib IdP will return a NameID with format of urn:oasis:names:tc:SAML:2.0:nameid-format:transient.<br>
<br>Best,<br clear="all"></span>Yaowen<br>
<br><br><div class="gmail_quote">On Wed, Aug 1, 2012 at 5:51 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Yaowen,<div><br></div><div><div><div class="im"><blockquote type="cite"><span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px">What I want to know is, if SP specify transient, it is very clear that the value will be a temporary number. but if SP specify "<a>urn:mace:shibboleth:1.0:nameIdentifier</a>" as the format, SP still doesn't know what will be the value inside the NameID. SP only knows that this value can represent this user. It can be email address, give name, or what ever. This is defined by IdP. Is that correct? Is there a place that defined what can be put inside the "nameIdentifier" so IdP and SP will follow this rule?<br>
</span></blockquote><div><br></div></div><div><a>urn:mace:shibboleth:1.0:nameIdentifier</a> has reasonably precisely defined semantics. See section 3.3 of the old Shibboleth specification:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/download/attachments/2162702/internet2-mace-shibboleth-arch-protocols-200509.pdf?version=1&modificationDate=1336585664438" target="_blank">https://wiki.shibboleth.net/confluence/download/attachments/2162702/internet2-mace-shibboleth-arch-protocols-200509.pdf?version=1&modificationDate=1336585664438</a></div>
<div><br></div><div>It's effectively a legacy transientId for use with the Shibboleth edition of SAML 1.1.</div><div class="im"><br><blockquote type="cite">Also it says "urn.....<span style="color:rgb(153,0,0)">shibboleth:1.0</span>:nameIdentifier", does it mean it only works for SAML1.0? If I send a SAML2.0 AuthnRequest, will IdP return this?<br>
</blockquote></div></div><br></div><div>The IdP could hypothetically be configured to send this NameID using the SAML 2.0 protocol, but I think that would be a very unwise choice.</div><div><br></div><div>There's a reason that identifiers are well-typed: so that the SP knows what, if anything, to do with them once they're received. I'd strongly suggest choosing the right identifier type for the identifier you'd like to send.</div>
<div><br></div><div>If you have a use case that you'd like to discuss, please let us know.</div><div><br></div><div>Take care,</div><div>Nate.</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>