Re: ConfirmationMethod missing in SubjectType (sourceid 1.1, ID-FF 1.1)
Bryan Field-Elliot <[email protected]> Tue, 22 Mar 2005 07:51:30 -0700
| Newsgroups | gmane.comp.sourceid.sso.user |
|---|---|
| Message-ID | <[email protected]> |
--===============1465919613== Content-Type: multipart/alternative; boundary="=-xidAb2Grd5pki8/RufwB" --=-xidAb2Grd5pki8/RufwB Content-Type: text/plain Content-Transfer-Encoding: 7bit Thank you Peter, Upon looking at this, you are right, this is a bug. Not because the toolkit itself is behaving funny, but because a "MUST" clause in the fine-print of the SAML protocol is not being adhered to correctly -- the Confirmation Method should be set to "Bearer" in the case of the POST profile. That said, this is a bug which has been in the code for two years, and has not been noticed or rejected by any other vendors, nor has it hindered SourceID's ability to earn and retain the official Liberty Conformance Certification. In Authenticator.java, there is a block of code which sets the confirmation method to "Artifact" in the case of the Browser-Artifact profile. This little block of code should be extended to put the Bearer string in there, in the event of the POST profile. With regards to your other question -- SourceID 1.1 has no use for the Format and NameQualifier fields of the Subject Identifier, which is why it leaves them blank when issuing new ones. (Although, it of course honors the contents of those fields when issued by another vendor's toolkit). With ID-FF 1.2, the meaning of these fields changes dramatically (and they become mandatory), so you will see them being used in a real sense with that version. Thanks again, Bryan On Mon, 2005-03-21 at 23:39 +0100, [email protected] wrote: > Hi > > I'm trying to test sourceid 1.1 (as IDP) with the sun java system access > manager 6.3 (as SP). However, the AuthnResponse to a federation request is > not accepted by access manager. Some digging reveals that the response (browser > post profile) from sourceid does not contain the ConfirmationMethod element > in the SubjectType, as it seems to be required by SAML 1.0 (on which ID-FF > 1.1 is based). Could someone confirm this? Is this a bug in sourceid, or > am I misinterpreting the specs? > > In the browser artifact profile, the response from sourceid seems to lack > the Format and NameQualifier in the NameIdentifier element. Comments? > > (I'm using sourceid 1.1 because an IDP has based their system on this version > of the framework) > > thanks & regards, Peter > > _______________________________________________ > sso-users mailing list > [email protected] > http://lists.sourceid.org/mailman/listinfo/sso-users --=-xidAb2Grd5pki8/RufwB Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/3.3.2"> </HEAD> <BODY> Thank you Peter,<BR> <BR> Upon looking at this, you are right, this is a bug. Not because the toolkit itself is behaving funny, but because a "MUST" clause in the fine-print of the SAML protocol is not being adhered to correctly -- the Confirmation Method should be set to "Bearer" in the case of the POST profile. <BR> <BR> That said, this is a bug which has been in the code for two years, and has not been noticed or rejected by any other vendors, nor has it hindered SourceID's ability to earn and retain the official Liberty Conformance Certification.<BR> <BR> In Authenticator.java, there is a block of code which sets the confirmation method to "Artifact" in the case of the Browser-Artifact profile. This little block of code should be extended to put the Bearer string in there, in the event of the POST profile.<BR> <BR> With regards to your other question -- SourceID 1.1 has no use for the Format and NameQualifier fields of the Subject Identifier, which is why it leaves them blank when issuing new ones. (Although, it of course honors the contents of those fields when issued by another vendor's toolkit). <BR> <BR> With ID-FF 1.2, the meaning of these fields changes dramatically (and they become mandatory), so you will see them being used in a real sense with that version.<BR> <BR> Thanks again,<BR> <BR> Bryan<BR> <BR> <BR> On Mon, 2005-03-21 at 23:39 +0100, [email protected] wrote: <BLOCKQUOTE TYPE=CITE> <PRE> <FONT COLOR="#000000">Hi</FONT> <FONT COLOR="#000000">I'm trying to test sourceid 1.1 (as IDP) with the sun java system access</FONT> <FONT COLOR="#000000">manager 6.3 (as SP). However, the AuthnResponse to a federation request is</FONT> <FONT COLOR="#000000">not accepted by access manager. Some digging reveals that the response (browser</FONT> <FONT COLOR="#000000">post profile) from sourceid does not contain the ConfirmationMethod element</FONT> <FONT COLOR="#000000">in the SubjectType, as it seems to be required by SAML 1.0 (on which ID-FF</FONT> <FONT COLOR="#000000">1.1 is based). Could someone confirm this? Is this a bug in sourceid, or</FONT> <FONT COLOR="#000000">am I misinterpreting the specs?</FONT> <FONT COLOR="#000000">In the browser artifact profile, the response from sourceid seems to lack</FONT> <FONT COLOR="#000000">the Format and NameQualifier in the NameIdentifier element. Comments?</FONT> <FONT COLOR="#000000">(I'm using sourceid 1.1 because an IDP has based their system on this version</FONT> <FONT COLOR="#000000">of the framework)</FONT> <FONT COLOR="#000000">thanks & regards, Peter</FONT> <FONT COLOR="#000000">_______________________________________________</FONT> <FONT COLOR="#000000">sso-users mailing list</FONT> <FONT COLOR="#000000"><A HREF="mailto:[email protected]">[email protected]</A></FONT> <FONT COLOR="#000000"><A HREF="http://lists.sourceid.org/mailman/listinfo/sso-users">http://lists.sourceid.org/mailman/listinfo/sso-users</A></FONT> </PRE> </BLOCKQUOTE> </BODY> </HTML> --=-xidAb2Grd5pki8/RufwB-- --===============1465919613== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ sso-users mailing list [email protected] http://lists.sourceid.org/mailman/listinfo/sso-users --===============1465919613==--