Shibboleth Developers

[Tom Scavo <>]

On 10/8/05, Scott Cantor 
<>
 wrote:
>
> If you're going to invent new profiles
> or protocols in SAML 1.1, I'd just reinvent NameID mapping from 2.0,

Hmm, I'm not so sure.  NameIDMappingRequest is intended for use by SPs
that already possess a NameID for the principal in question, so the
old NameID must be included in the request.  In other words, the Name
Identifier Mapping Protocol assumes an act of authentication has
already occurred.  In our case, the act of authentication occurs at
the time of request.

> I wouldn't bother with authentication assertions that aren't being used
> for authentication.

Well, authn assertions have <saml:Conditions> elements, which we sorta
need in this case since the lifetime of the name identifier must match
the lifetime of the proxy cert.  [SAML2Prof] encourages this, in fact:

  Additional limits on the use of the resulting identifier MAY be applied
  by the identity provider by returning the mapped name identifier in the
  form of an <Assertion> containing the identifier in its <Subject> but
  without any statements.

This is not possible in SAML 1.1, however, since the <saml:Subject>
element is tied up in the statement.  Also, it's not at all clear how
the desired lifetime should be communicated to the IdP.

Tom