<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10px"><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr"><span>OK, Their MD says persistent: </span> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat></div><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr"><br></div><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr">So then my final question becomes - What do I need to do to make nameID pass as one of the request headers back to my protected resource?</div><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr"><br></div><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr"><br></div><blockquote class="" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;" id="yui_3_16_0_1_1411742948922_34938">I am currently having a conversation with SuccessFactors / BizX with<br class="" style="">regard to their requiring that we use nameID as a unique, immutable ID<br class="" style="">token for the user.<br class="" style=""></blockquote><div id="yui_3_16_0_1_1411742948922_34682" dir="ltr" class="" style=""><span class="" style="color: rgb(80, 0, 80); font-family: arial, sans-serif; font-size: 16px;"><br class="" style=""></span><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34937">The basic answer is, please identify the SAML standard format you want to</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34936">use. If they intend to use "persistent", then they aren't doing anything</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34935">but what Shibboleth already does by default. If they say something else,</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34934">they're either misusing another format, using unspecified, or very less</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34939">likely actually minting a custom format.</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34933">The problem is interoperability and having things "just work" with</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34932">well-defined semantics, and while higher ed/EduPerson isn't perfect, it's</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34931">about the only game in town. The rest of the market has no such standard</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34930">to follow so they just make it all up, or in most cases use unspecified.</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""></div><blockquote class="" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px; margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">Is this appropriate?<br class="" style=""></blockquote><div dir="ltr" class="" style="" id="yui_3_16_0_1_1411742948922_34929"><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34940">Yes, but what's not appropriate is treating the field as some kind of</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34941">one-off agreement. If you use NameID, you should have a Format to point to</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="">that has standard semantics.</span><span class="" style="color: rgb(80, 0, 80); font-family: arial, sans-serif; font-size: 16px;"><br class="" style=""><br class="" style=""></span></div><blockquote class="" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;" id="yui_3_16_0_1_1411742948922_34928">If appropriate, can I configure my SP (v2.3.1) to pass nameID to the<br class="" style="">protected resource in some fashion?<br class="" style=""></blockquote><div dir="ltr" id="yui_3_16_0_1_1411742948922_34927"><span class="" style="color: rgb(80, 0, 80); font-family: arial, sans-serif; font-size: 16px;"><br class="" style=""></span><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34942">Yes, but what you can't do, for example, is map a given Format (particular</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34943">the aforementioned "unspecified") to a different header for each IdP. And</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34944">that's the risk, when you don't have clear definitions in play, you may</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34945">end up with two IdPs trying to use the same Format when they don't provide</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="" id="yui_3_16_0_1_1411742948922_34946">the same guarantees around the data.</span><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><br style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 16px;" class="">-- Scott</span><br></div> <div class="qtdSeparateBR" id="yui_3_16_0_1_1411742948922_35888"><br><br></div><div class="yahoo_quoted" style="display: block;" id="yui_3_16_0_1_1411742948922_35885"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 10px;" id="yui_3_16_0_1_1411742948922_35884"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1411742948922_35883"> <div dir="ltr" id="yui_3_16_0_1_1411742948922_35887"> <font size="2" face="Arial" id="yui_3_16_0_1_1411742948922_35886"> On Friday, September 26, 2014 7:54 AM, Mike Flynn <shibbolethlynda@yahoo.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container" id="yui_3_16_0_1_1411742948922_35897"><div id="yiv3031265103"><div id="yui_3_16_0_1_1411742948922_35896"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10px;" id="yui_3_16_0_1_1411742948922_35895"><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span>I am currently having a conversation with SuccessFactors / BizX with regard to their requiring that we use nameID as a unique, immutable ID token for the user. Typically we use things like targeted-id/eppn/UID etc - Attributes passed to us. I am trying to understand the following:</span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span><br clear="none"></span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span>Is this appropriate?</span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span id="yiv3031265103yui_3_16_0_1_1411742948922_11754">If appropriate, can I configure my SP (v2.3.1) to pass nameID to the protected resource in some fashion? Should I expect Successfactors to pass it as an attribute?</span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span><br clear="none"></span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span>Thanks</span></div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411742948922_11569"><span><br clear="none"></span></div> <div class="yiv3031265103qtdSeparateBR"><br clear="none"><br clear="none"></div><div class="yiv3031265103yqt6098465377" id="yiv3031265103yqt18314"><div class="yiv3031265103yahoo_quoted" style="display: block;" id="yui_3_16_0_1_1411742948922_35894"> <div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10px;" id="yui_3_16_0_1_1411742948922_35893"> <div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yui_3_16_0_1_1411742948922_35892"> <div dir="ltr"> <font size="2" face="Arial"> On Thursday, September 25, 2014 12:40 PM, Mike Flynn <shibbolethlynda@yahoo.com> wrote:<br clear="none"> </font> </div> <br clear="none"><br clear="none"> <div class="yiv3031265103y_msg_container" id="yui_3_16_0_1_1411742948922_35891"><div id="yiv3031265103"><div id="yui_3_16_0_1_1411742948922_35890"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10px;" id="yui_3_16_0_1_1411742948922_35889"><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4617">In the OASIS docs, I see this:</div><div dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4587"><br clear="none"></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4586" style="">The optional <Subject> element specifies the <b>principal </b>that is the subject of all of the (zero or more)</div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4588" style="">statements in the assertion.</div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><br clear="none"></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style="">In the glossary it is defined as this:</div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><br clear="none"></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><span class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;">A </span><i class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;">system entity</i><span class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;" id="yui_3_16_0_1_1411742948922_35898"> whose identity can be authenticated. [X.811]</span><br clear="none"></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><span class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;"><br clear="none"></span></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><span class="yiv3031265103" id="yiv3031265103yui_3_16_0_1_1411673842943_4637" style="font-family:Arial, sans-serif;font-size:13px;">What exactly is meant by system entity? Does the principal in an assertion have any association with the user specific data being passed as attributes?</span></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><span class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;"><br clear="none"></span></div><div class="yiv3031265103" dir="ltr" id="yiv3031265103yui_3_16_0_1_1411673842943_4589" style=""><span class="yiv3031265103" style="font-family:Arial, sans-serif;font-size:13px;">Thanks.</span></div><div></div></div></div></div><br clear="none"><br clear="none"></div> </div> </div> </div></div> </div></div></div><br><br></div> </div> </div> </div> </div></body></html>