Versions Compared

Old Version 1

changes.mady.by.user Niels van Dijk

Saved on

compared with

New Version 2

changes.mady.by.user Niels van Dijk

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

In a persistent identifier scenario, the RP requests a transient persistent identifier using the transient persistent scope, and should receive a pairwise sub per transactionRP, regardless of which persistent Identifier attributes we received from the SAML IdP as an identifier.
We cannot deliver a persistent Identifier if we do not get any persistent Identifier from the SAML IdP

...

ConfigurationParameters (for SSP)Expected Result

Transient SAML NameID, eduPersonAffiliation and SchacHomeOrganization

IdP: release

  • persistent SAML nameID
  • edupersonaffiliation
  • schachomeorganization

RP request:

  • persistent scope
  • student scope
NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
urn:oid:1.3.6.1.4.1.25178.1.2.9 = example.org
urn:oid:1.3.6.1.4.1.5923.1.1.1.1 = student
  • TRANSACTION MUST FAIL, as we have no persistent ID to base our response on.
  • Redirect to invalid attributes page



Transient SAML NameID, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope
NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org
  • TRANSACTION MUST FAIL, as we have no persistent ID to base our response on.
  • Redirect to invalid attributes page





Transient SAML NameID, eduPersonPrincipleName, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID
  • edupersonPrincipleName

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient

urn:oid:1.3.6.1.4.1.5923.1.1.1.6 = username@example.org

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org

  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • edupersonPrincipleName is the basis for the pairwise sub value



Transient SAML NameID,

eduPersonPrincipleName

eduPersonUniqueID, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID
  • edupersonPrincipleNameedupersonUniqueID

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient

urn:oid:1.3.6.1.4.1.5923.1.1.1.6 13 = username@example3290vdsjk2njks9@example.org

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org
  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • edupersonUniqueID is the basis for the pairwise sub value



Transient SAML NameID,

eduPersonUniqueID

eduPersonTargetedD, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID
  • edupersonUniqueIDedupersonTargetedID

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient

urn:oid:1.3.6.1.4.1.5923.1.1.1.13 = 3290vdsjk2njks9@example10 = a6c2c4d4-08b9-4ca7-8ff9-43d83e6e1d35 

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org


For config of ssp for generating ePTiD, see https://simplesamlphp.org/docs/1.5/simplesamlphp-authproc#section_2_5

  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • edupersonTargetedID is the basis for the pairwise sub value



Persistent SAML NameID, eduPersonAffiliation and SchacHomeOrganization

IdP: release

  • persistent SAML nameID
  • edupersonaffiliation
  • schachomeorganization

RP request:

  • persistent scope
  • student scope
NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
urn:oid:1.3.6.1.4.1.25178.1.2.9 = example.org
urn:oid:1.3.6.1.4.1.5923.1.1.1.1 = student
  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • persistent SAML nameID is the basis for the pairwise sub value



Persistent SAML NameID, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope
NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org
  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.



Transient

Persistent SAML NameID,

eduPersonTargetedD

eduPersonPrincipleName, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID
  • edupersonUniqueIDedupersonPrincipleName

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transientpersistent

urn:oid:1.3.6.1.4.1.5923.1.1.1.10 = a6c2c4d4-08b9-4ca7-8ff9-43d83e6e1d35 6 = username@example.org

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.orgFor config of ssp for generating ePTiD, see https://simplesamlphp.org/docs/1.5/simplesamlphp-authproc#section_2_5

  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • We must use the SAML nameID to base our identifier on, as ePPN may be reassigned.



Persistent SAML NameID, eduPersonUniqueID, eduPersonScopedAffiliation

IdP: release

  • transient SAML nameID
  • edupersonUniqueID

  • eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

urn:oid:1.3.6.1.4.1.5923.1.1.1.13 = 3290vdsjk2njks9@example.org

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org
  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • We must use the edupersonUniqueID to base our identifier on, as ePPN may be reassigned.



Persistent SAML NameID,

eduPersonAffiliation and SchacHomeOrganization

eduPersonTargetedD, eduPersonScopedAffiliation

IdP: release

  • persistent transient SAML nameID
  • edupersonaffiliationedupersonTargetedID
  • schachomeorganization

    eduPersonScopedAffiliation

RP request:

  • persistent scope
  • student scope

NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

urn:oid:1.3.6.1.4.1.

25178

5923.1.1.

2

1.

9 = example.org

10 = a6c2c4d4-08b9-4ca7-8ff9-43d83e6e1d35 

urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org


For config of ssp for generating ePTiD, see https://simplesamlphp.1 = studentorg/docs/1.5/simplesamlphp-authproc#section_2_5
  • Student validation PASS
  • Affiliate validation PASS
  • Employee validation FAIL
  • RP receives a pairwise sub for each transaction.
  • We must use the edupersonTargetedID to base our identifier on, as ePPN may be reassigned.