Export NameIDFormat in metadata according to configuration (was #604) about simplesamlphp HOT 2 CLOSED

From [email protected] on January 28, 2014 04:29:54

I think looking at NameID generation filters may be challenging, at least as they are designed now. What exact NameIDs can be generated depends on the general authentication processing filters (in "authproc.idp" in config.php), the filters configured in the IdP metadata, and the filters in SP metadata. In addition, it depends on the user's attributes.

The filters, as they are currently designed, are not meant to communicate any information about what formats they may generate. They are only designed to attempt to generate NameIDs, and store them in the state array.

I do not think we should add an additional function to the NameID filters in order to allow them to communicate what they may generate. It would be a drastic change from the way filters are currently designed. Now they are just pieces of code that should run in some sequence in order to navigate the authentication process from login to authentication response generation.

I think the more proper solution would be to allow the IdP to include multiple entries in the NameIDFormat option in idp-hosted metadata, and use that option only for generating the XML IdP metadata.

The NameIDFormat in sp-remote metadata should probably be some sort of policy, listing which NameIDFormat values the SP is allowed to receive, but that will probably break some SPs. I would therefore avoid that change until SSP 2.0.

from simplesamlphp.

This has been fixed at some point in the past.

from simplesamlphp.