Shibboleth Developers

[Chad La Joie <>]

David L. Wasley wrote:
> Bob,
> -----
> At 1:05 AM +0200 on 8/1/05, RL 'Bob' Morgan wrote:
>
> > ....
> >
> > If we thought this happened a lot, we might think that there needs to 
> > be a UI at the IdP for an IdP user to pick an SP and say "forget my 
> > current ePTID with this one".  I don't think we need this, though.  I 
> > think the "de-federation" support that Scott mentions in SAML 2 would 
> > be initiated by UI at the SP (but I could be wrong about that).
> >
> >  - RL "Bob"
>
>
> I think "we" need exactly that "UI at the IDP for an IdP user to pick an 
> SP and say "forget my current ePTID with this one".  That's one small 
> way to achieve at least some level of anonymity, if the User cares to.
>
> Clearly there are cases where that would be inappropriate but in those 
> cases the SP should not accept an identifier that changes, or should 
> have a way of re-establishing the actual association (with the User's 
> knowledge).

Yeah, as Scott mentioned, Liberty takes this view, where the user is 
prompted for permission to establish this linking.  I do wonder though 
if SPs should be allowed to dictate whether or not an IdP can effect 
this kind of change.  Personally I think not, I do think they have every 
right to require that IdPs inform them quickly/immediately when they are 
making such changes so that the SP can take appropriate actions on their 
side.

I guess this all goes back to my view though that the IdP, not the SP, 
is the place where users should create/defederate ePTIDs.

> WRT the SP "de-federating" (defenestrating?) a User, I assume that would 
> be the equivalent of closing an account.  Wouldn't the SP simply remove 
> the ePTID from their ACL (or whatever) so that it was no longer useful?

In many cases, SPs that need the ePTID probably won't have it in an ACL 
anywhere (though they may).  I think mostly it'll be used as a key to 
user information such as preferences, shopping histories, whatever.  So 
it's probably less about correcting ACLs upon de-federating an ID and 
more about cleaning up used resources.

But either way, if an IdP is nice and sends a ManageNameId message to 
the SP it should be able to take whatever actions are needed.
--
Chad La Joie             315Q St. Mary's Hall
Project Sentinel         202.687.0124