Title: RE: [security-services] Errata for NameIDPolicy
So the new proposed text is below.
Is there any constraints on the NameID values in SubjectConfirmation (related to NameIDPolicy)?
"When a Format defined in Section 8.3.7 is used other than urn:oasis:names:TC:SAML:2.0:nameid-format:unspecified or urn:oasis:names:TC:SAML:2.0:nameid-format:encrypted, then if the identity provider returns any assertions:
- the Format value of the <NameID> within the <Subject> of any <Assertion> MUST be identical to the Format value supplied in the <NameIDPolicy>, and
- if SPNameQualifier is not omitted in <NameIDPolicy>, the SPNameQualifier value of the <NameID> within the <Subject> of any <Assertion> MUST be identical to the SPNameQualifier value supplied in the <NameIDPolicy>."
Tom.
-----Original Message-----
From: Scott Cantor [mailto:]
Sent: Friday, June 03, 2005 1:01 PM
To: 'Thomas Wisniewski'; 'SAML'
Subject: RE: [security-services] Errata for NameIDPolicy
> "When a Format defined in Section 8.3.7 is used other than
> urn:oasis:names:TC:SAML:2.0:nameid-format:unspecified or
> urn:oasis:names:TC:SAML:2.0:nameid-format:encrypted, then if
> the identity provider returns any assertions, the Format
> value of the <NameID> within any <Assertion> MUST be
> identical to the Format value supplied in the <NameIDPolicy>.
Small clarification, I'd change that to:
"value of the <NameID> within the <Subject> of any <Assertion> MUST be..."
NameID shows up inside subject confirmation also, just wanted to be precise.
> If the Format value is set to
> urn:oasis:names:TC:SAML:2.0:nameid-format:persistent and if
> the SPNameQualifier is not omitted, then if the identity
> provider returns any assertions, the SPNameQualifier value of
> the <NameID> within any <Assertion> MUST be identical to the
> SPNameQualifier value supplied in the <NameIDPolicy>."
I don't think we need to constrain this to persistent. SPNameQualifier is currently a SHOULD NOT as far as using it with anything else because no other format defines its use, but if a new one does, that's fine.
I think it should simply be "match it" without regard to the format.
-- Scott
