Re: [SourceID SSO-users] ConfirmationMethod missing in SubjectType (sourceid 1.1

Hi Brian

many thanks for the feedback. I had again a closer look at the SAML 1.0 s=
pec
and I believe now that these fields are actually optional! however, I alr=
eady
successfully added the code you are suggesting below and this seems to ge=
t
this part working. I also had to set the NameQualifier though.=20

My next stumbling block is now the federation termination initiated by ac=
cess
manager (as SP). It seems access manager does not sign the request, so so=
urceid
does not accept it. Did not check so far if the signature is a requiremen=
t.

regards, Peter

>-- Original-Nachricht --
>Subject: Re: [SourceID SSO-users] ConfirmationMethod missing in SubjectT=
ype
>	(sourceid 1.1, ID-FF 1.1)
>From: Bryan Field-Elliot <[email protected]>
>To: SourceID Users List <[email protected]>
>Date: Tue, 22 Mar 2005 07:51:30 -0700
>Reply-To: SourceID Users List <[email protected]>
>
>
>Thank you Peter,
>
>Upon looking at this, you are right, this is a bug. Not because the
>toolkit itself is behaving funny, but because a "MUST" clause in the
>fine-print of the SAML protocol is not being adhered to correctly --
>the Confirmation Method should be set to "Bearer" in the case of the
>POST profile.=20
>
>That said, this is a bug which has been in the code for two years, and
>has not been noticed or rejected by any other vendors, nor has it
>hindered SourceID's ability to earn and retain the official Liberty
>Conformance Certification.
>
>In Authenticator.java, there is a block of code which sets the
>confirmation method to "Artifact" in the case of the Browser-Artifact
>profile. This little block of code should be extended to put the Bearer
>string in there, in the event of the POST profile.
>
>With regards to your other question -- SourceID 1.1 has no use for the
>Format and NameQualifier fields of the Subject Identifier, which is why
>it leaves them blank when issuing new ones. (Although, it of course
>honors the contents of those fields when issued by another vendor's
>toolkit).=20
>
>With ID-FF 1.2, the meaning of these fields changes dramatically (and
>they become mandatory), so you will see them being used in a real sense
>with that version.
>
>Thanks again,
>
>Bryan
>
>
>On Mon, 2005-03-21 at 23:39 +0100, [email protected] wrote:
>
>> Hi
>>=20
>> I'm trying to test sourceid 1.1 (as IDP) with the sun java system acce=
ss
>> manager 6.3 (as SP). However, the AuthnResponse to a federation reques=
t
>is
>> not accepted by access manager. Some digging reveals that the response
>(browser
>> post profile) from sourceid does not contain the ConfirmationMethod el=
ement
>> in the SubjectType, as it seems to be required by SAML 1.0 (on which I=
D-FF
>> 1.1 is based). Could someone confirm this? Is this a bug in sourceid,
or
>> am I misinterpreting the specs?
>>=20
>> In the browser artifact profile, the response from sourceid seems to l=
ack
>> the Format and NameQualifier in the NameIdentifier element. Comments?
>>=20
>> (I'm using sourceid 1.1 because an IDP has based their system on this
version
>> of the framework)
>>=20
>> thanks & regards, Peter
>>=20
>> _______________________________________________
>> sso-users mailing list
>> [email protected]
>> http://lists.sourceid.org/mailman/listinfo/sso-users
>_______________________________________________
>sso-users mailing list
>[email protected]
>http://lists.sourceid.org/mailman/listinfo/sso-users