Shibboleth Developers

["Tom Scavo" <>]

This use case distills the common requirements of various grid
projects I've worked on, and so it might be called the "Grid Use
Case":

1. The IdP asserts an SSO assertion with the following characteristics:
  * The assertion is unencrypted
  * There is a digital signature on the <Assertion> element
  * The <AuthnContext> element distinguishes between two levels of assurance
  * The IdP asserts a persistent, non-reassignable identifier (encrypted)
  * The assertion may contain non-identity attributes such as ePSA 
(unencrypted)
2. The SP decrypts the identifier and maps it to a persistent, local
identifier (account linking).
3. The SP resolves local attributes and issues a local attribute
assertion with bound SSO assertion (in <Advice>).
4. SP exposes the local attribute assertion to the application.

Questions:

* Can the Shib IdP 2.0 be made to issue such an assertion?
* Will the Shib SP 2.0 do account linking?
* Will the Shib SP 2.0 do local attribute resolution?
* If the answer to the previous question is no, will the Shib SP 2.0
expose the raw SSO assertion?

Thanks,
Tom