...
InCommon Operations will add identity assurance qualifiers (IAQs) to the published metadata following notification of certification by InCommon management. IAQs will be applied added to the relevant appropriate IdP entity descriptors descriptor of the certified IdP operators operator (IdPOsIdPO).
Proposed IAQ URIs are:
Silver: http://id.incommon.org/assurance/silver
Bronze: http://id.incommon.org/assurance/bronze
...
The <mdattr:EntityAttributes> element and the name of the <saml:Attribute> element are defined by relevant OASIS specifications.
Issues
- The entity attribute and/or the IAQ has to be dated or versioned to indicate exactly what IAP is referred to.
SP behavior
Ideally SPs will initiate the assurance flow by including the desired IAQ in the SAML AuthnRequest element.
...
SPs will receive IAQs (either in response to a specific request, or sent unsolicited) in assertions from IdPs. SPs should use metadata to check that the IdP is authorized to assert the IAQs being asserting.
SPs will rely on local policy to decide how to handle incoming IAQs. For example if the SP requires InCommon Bronze but receives InCommon Silver, that should be acceptable.
Issues
- Some SPs may not be able to use the AuthnRequest mechanism due to software or other limitations. Are they simply out of luck?
- How is this the AuthnRequest configured using the Shib SP? The simpleSAMLphp SP?
- Boarding process: Since an IAQ in metadata makes a statement about certification (not live service), how does an SP determine that an IdP supports assurance operationally (ala attribute support)? One approach is to include
<saml:Attribute>elements in IdP metadata. Other approaches?
...
- Does the Shib (or simpleSAMLphp) SP software support the metadata check?
...
- Does the simpleSAMLphp SP?
- What matching rules are recommended, or acceptable?
- How is an SP supposed to "know"
...
- that Silver is acceptable in lieu of Bronze? Is there a role for
...
- InCommon to provide "advice"?
IdP behavior
Ideally IdPs will receive a desired IAQ from an SP in an AuthnRequest to initiate the process. The IdP compares the requested IAQ to its matching rule and interacts with the local IdM system to determine if the current user meets the requirements. If so, the appropriate IAQ is returned in the AuthnContext element in the assertion.
Issues
- What matching rules are supported?
- If the SP requests Bronze, is it allowable for the IdP return Silver? How does the IdP "know" the mapping? Is there a role for InC to provide "advice"?
- Is it possible and/or desirable for the IdP to return multiple IAQs? No, not using the AuthnContext element.
- How does the Shib (or SSP) IdP interact with local IdM? Is a custom login handler required?
...
- Same question for simpleSAMLphp.
- If an SP does not assert an IAQ in an AuthnRequest and the current user meets the requirements for one or more IAQs, should the IdP assert the IAQ(s).
- Can the Shib (or SSP) IdP be configured to send IAQs without being requested?
- If so, what are the appropriate policy knobs (per-SP, per-user, whatever)?
...