OpenSAML user discussion

["Scott Cantor" <>]

In future, please use the saml-dev or security-services-comment lists at
OASIS, this isn't a general SAML question list.

> In SAML 2.0, the AuthnRequest can be sent from the service provider  
> with the user to the IdP before the user is authenticated (Service  
> first Web browser SSO Profile).

It normally is sent before.

> I wonder what the subject element  
> should contain in this scenario.

Normally it's not present. If it is, it's usually as part of a
reauthentication and is just there as a sanity check.

> Should it contain an empty  
> subjectconfirmation and no nameidentifier ? What should the  
> subjectconfirmation@method
>  be?

The SSO profile specifically precludes passing a confirmation in the
request. Other profiles may not (and in fact do not, there's a Liberty
profile that uses it).

-- Scott