AuthnRequest Subject vs. NameIDPolicy usage

[Thomas Wisniewski <Thomas.Wisniewski@entrust.com>]

Title: Message

All, I'm trying to understand Profiles section 4.1.4.1 (<AuthnRequest> Usage). Specifically the fact that Subject is allowed and how this related to NameIDPolicy.  I assume the reason Subject is allowed is to because the requesting service provider may know the subject's identity and wants the identity provider to match this against the user being authenticated. It would seem that this should imply that NameIDPolicy's Format and SPNameQualifier attributes MUST be omitted in this case. The AllowCreate attribute could be used as it currently is. Is that the intent? If not and both are used such that the Format and/or SPNameQualifier attributes are defined in both (and of course possibily different), what would be the processing rules?

 

I'm proposing that these two attributes in NameIDPolicy not be used when using Subject.

 

Tom.

Thomas Wisniewski
Software Architect
Phone: (201) 891-0524
Cell: (201) 248-3668
 
EntrustÒ
Securing Digital Identities
& Information